Vendors and Products

CPE, which stands for Common Platform Enumeration, is a standardized scheme for naming hardware, software, and operating systems. CPE provides a structured naming scheme to uniquely identify and classify information technology systems, platforms, and packages based on certain attributes such as vendor, product name, version, update, edition, and language.

Name: Improper Session Management

The product does not properly manage user-related sessions such as setting appropriate configurations and settings for sessions on creation and handling sessions throughout their lifetime.

General Informations

Modes Of Introduction

Architecture and Design
Implementation

Applicable Platforms

Language

Class: Not Language-Specific (Undetermined)

Operating Systems

Class: Not OS-Specific (Undetermined)

Architectures

Class: Not Architecture-Specific (Undetermined)

Technologies

Class: Client Server (Undetermined)
Class: Web Based (Undetermined)

Observed Examples

References	Description
CVE-2020-6291	No absolute session expiration
CVE-2021-38869	Session was not invalidated after inactivity
CVE-2019-12421	Chain: log out invalidated the session on the client side (CWE-602), but not the server side (CWE-1464)

Potential Mitigations

Phases : Architecture and Design // Implementation // Operation
Very carefully manage user authenticated sessions. Ensure that appropriate timeouts, invalidation procedures, and protections are established.

Vulnerability Mapping Notes

Justification : This CWE Entry is a Class and might have lower-level children that would be more appropriate
Comment : Examine children of this entry to see if there is a better fit

Notes

This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.

References

REF-1540

Session Management Cheat Sheet
OWASP.
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

REF-1561

OWASP Web Security Testing Guide: 4.6 Session Management Testing
OWASP.
https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/06-Session_Management_Testing/

Submission

Name	Organization	Date	Date release	Version
CWE Content Team	MITRE	2026-10-22 +00:00	2026-10-28 +00:00	5.0

The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.

CWE-1462 Detail

CWE-1462