CWE-1462
Improper Session Management
2026-10-28
00h00 +00:00
00h00 +00:00
Incomplete
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Improper Session Management
The product does not properly manage user-related sessions such as setting appropriate configurations and settings for sessions on creation and handling sessions throughout their lifetime.
一般情報
導入モード
Architecture and DesignImplementation
適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)オペレーティングシステム
クラス： Not OS-Specific (Undetermined)アーキテクチャ
クラス： Not Architecture-Specific (Undetermined)テクノロジー
クラス： Client Server (Undetermined)クラス： Web Based (Undetermined)
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2020-6291 | No absolute session expiration |
CVE-2021-38869 | Session was not invalidated after inactivity |
CVE-2019-12421 | Chain: log out invalidated the session on the client side (CWE-602), but not the server side (CWE-1464) |
潜在的な緩和策
Phases : Architecture and Design // Implementation // OperationVery carefully manage user authenticated sessions. Ensure that appropriate timeouts, invalidation procedures, and protections are established.
脆弱性マッピングノート
理由 : This CWE Entry is a Class and might have lower-level children that would be more appropriateコメント : Examine children of this entry to see if there is a better fit
ノート
This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.参考文献
REF-1540
Session Management Cheat SheetOWASP.
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
REF-1561
OWASP Web Security Testing Guide: 4.6 Session Management TestingOWASP.
https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/06-Session_Management_Testing/
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 5.0 |
