CWE-613
DEPRECATED: Insufficient Session Expiration
2007-05-07
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: DEPRECATED: Insufficient Session Expiration
This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
一般資訊
漏洞對應備注
理由說明 : This CWE has been deprecated.備註 : See description and name for possible suggestions of other CWEs to consider.
備注
This CWE entry has been deprecated. For many years, the intention and usage of this CWE entry has evolved to include many notions of "sessions" that are not specific to the web. Instead of expanding the scope of this entry, it was split into multiple separate entries. The original WASC-47 entry [REF-1520] includes considerations forcing re-authentication for "inactivity" (expiring sessions after a period of inactivity) versus "absolute" (a fixed expiration time), with a goal to "keep the lifespan of a session ID as short as possible." However, this CWE was also used for situations in which a session is not fully invalidated or terminated upon logout, which is a different weakness than the original intention for this entry. There is also evidence that this CWE entry was used for session fixation (CWE-384).提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| WASC | Draft 6 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Sean Eidemiller | Cigital | added/updated demonstrative examples | |
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Maintenance_Notes, Mapping_Notes, Observed_Examples, References | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Maintenance_Notes, Mapping_Notes, Modes_of_Introduction, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type, Weakness_Ordinalities |
