CWE-488
AllowedExposure of Data Element to Wrong Session
Abstraction: Base · Status: Draft
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
75 vulnerabilities reference this CWE, most recent first.
GHSA-2252-4RMP-Q4VJ
Vulnerability from github – Published: 2026-10-01 12:31 – Updated: 2026-10-01 15:30Exposure of data element to wrong session vulnerability in Apache APISIX.
This issue affects Apache APISIX: from 2.3.0 before 3.7.0.
Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions.
Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-82806"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-01T11:17:28Z",
"severity": "MODERATE"
},
"details": "Exposure of data element to wrong session vulnerability in Apache APISIX.\n\n\n\nThis issue affects Apache APISIX: from 2.3.0 before 3.7.0.\n\n\n\nUnder a supported authz-keycloak configuration, a request\u0027s authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions.\n\n\n\nUsers are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.",
"id": "GHSA-2252-4rmp-q4vj",
"modified": "2026-10-01T15:30:39Z",
"published": "2026-10-01T12:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82806"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/wvkv2b4oy2fh9v79d30gtsy0bhqmzcdd"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3VC6-WMGR-GJ4Q
Vulnerability from github – Published: 2024-11-16 12:30 – Updated: 2024-11-16 12:30The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract sensitive data such as redirects including GET parameters which may reveal sensitive information.
{
"affected": [],
"aliases": [
"CVE-2024-11094"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-16T10:15:04Z",
"severity": "MODERATE"
},
"details": "The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract sensitive data such as redirects including GET parameters which may reveal sensitive information.",
"id": "GHSA-3vc6-wmgr-gj4q",
"modified": "2024-11-16T12:30:35Z",
"published": "2024-11-16T12:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11094"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3188844%40404-solution%2Ftrunk\u0026old=3169186%40404-solution%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d738be73-2573-4fb8-b6f0-768a08628265?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-49PC-8936-WVFP
Vulnerability from github – Published: 2026-02-20 21:14 – Updated: 2026-02-23 22:30Impact
Email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected.
Patches
Yes, the issue has been patched. Users should upgrade to v1.5.1 or later.
Workarounds
If upgrading immediately is not possible, instantiate a new client for each send:
const client = new Lettermint({ apiKey: process.env.LETTERMINT_API_KEY });
await client.email.to('...').subject('...').html('...').send();
This ensures no state is carried over between sends.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "lettermint"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-27492"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-20T21:14:49Z",
"nvd_published_at": "2026-02-21T11:15:57Z",
"severity": "MODERATE"
},
"details": "### Impact\nEmail properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence \u2014 such as transactional flows like password resets or notifications \u2014 are affected.\n\n### Patches\nYes, the issue has been patched. Users should upgrade to v1.5.1 or later.\n\n### Workarounds\nIf upgrading immediately is not possible, instantiate a new client for each send:\n```js\nconst client = new Lettermint({ apiKey: process.env.LETTERMINT_API_KEY });\nawait client.email.to(\u0027...\u0027).subject(\u0027...\u0027).html(\u0027...\u0027).send();\n```\n\nThis ensures no state is carried over between sends.",
"id": "GHSA-49pc-8936-wvfp",
"modified": "2026-02-23T22:30:18Z",
"published": "2026-02-20T21:14:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27492"
},
{
"type": "WEB",
"url": "https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1"
},
{
"type": "PACKAGE",
"url": "https://github.com/lettermint/lettermint-node"
},
{
"type": "WEB",
"url": "https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused"
}
GHSA-6C5R-PJ95-XVQV
Vulnerability from github – Published: 2026-07-29 21:30 – Updated: 2026-07-29 21:30In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
{
"affected": [],
"aliases": [
"CVE-2026-16326"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-29T19:16:44Z",
"severity": "CRITICAL"
},
"details": "In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client\u0027s Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.",
"id": "GHSA-6c5r-pj95-xvqv",
"modified": "2026-07-29T21:30:59Z",
"published": "2026-07-29T21:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16326"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7W6R-748W-MH52
Vulnerability from github – Published: 2025-01-09 09:31 – Updated: 2025-02-06 19:50A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pgadmin4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-1907"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-09T17:34:19Z",
"nvd_published_at": "2025-01-09T08:15:24Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user\u0027s session if multiple connection attempts occur simultaneously.",
"id": "GHSA-7w6r-748w-mh52",
"modified": "2025-02-06T19:50:22Z",
"published": "2025-01-09T09:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1907"
},
{
"type": "WEB",
"url": "https://github.com/pgadmin-org/pgadmin4/issues/6100"
},
{
"type": "WEB",
"url": "https://github.com/pgadmin-org/pgadmin4/commit/fa29ba91632634d961f937ce3ed2c3b5a9d78f59"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-1907"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218384"
},
{
"type": "PACKAGE",
"url": "https://github.com/pgadmin-org/pgadmin4"
},
{
"type": "WEB",
"url": "https://github.com/pgadmin-org/pgadmin4/blob/a9974b418c49760d3989b7fb25e052ff16b89ac6/docs/en_US/release_notes_7_0.rst"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "pgAdmin has Incorrect Default Permissions"
}
GHSA-82VP-JR39-4J2J
Vulnerability from github – Published: 2024-05-30 18:22 – Updated: 2024-05-30 18:22It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-core"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.7.27"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-30T18:22:41Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.",
"id": "GHSA-82vp-jr39-4j2j",
"modified": "2024-05-30T18:22:41Z",
"published": "2024-05-30T18:22:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TYPO3-CMS/core/commit/c8c08ca0c26db02753c243e175a8a045628341b6"
},
{
"type": "WEB",
"url": "https://github.com/TYPO3-CMS/core/commit/fe43834075ae283c8cd91949e9f1dfd18b2d492f"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-06-25-3.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3-CMS/core"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-core-sa-2019-018"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "TYPO3 Security Misconfiguration in Frontend Session Handling"
}
GHSA-88C6-6JFQ-MM4Q
Vulnerability from github – Published: 2026-07-03 09:31 – Updated: 2026-07-06 18:30libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'.
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
{
"affected": [],
"aliases": [
"CVE-2026-8458"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T07:16:24Z",
"severity": "MODERATE"
},
"details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\u0027services\u0027.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.",
"id": "GHSA-88c6-6jfq-mm4q",
"modified": "2026-07-06T18:30:47Z",
"published": "2026-07-03T09:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3721183"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-8458.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-8458.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8RWG-XF8H-29M3
Vulnerability from github – Published: 2026-10-01 09:30 – Updated: 2026-10-01 09:30A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2026-103544"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-01T07:16:33Z",
"severity": "LOW"
},
"details": "A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.",
"id": "GHSA-8rwg-xf8h-29m3",
"modified": "2026-10-01T09:30:32Z",
"published": "2026-10-01T09:30:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/datadrivenconstruction/OpenConstructionERP/security/advisories/GHSA-wfpw-cv5v-64j5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103544"
},
{
"type": "WEB",
"url": "https://github.com/datadrivenconstruction/OpenConstructionERP"
},
{
"type": "WEB",
"url": "https://github.com/datadrivenconstruction/OpenConstructionERP/releases/tag/v15.0.0"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-103544"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/957984"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/412354"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/412354/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9442-GM4V-R222
Vulnerability from github – Published: 2024-06-20 15:31 – Updated: 2026-02-27 21:38A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0.Alpha1"
},
{
"fixed": "2.3.14.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.33.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-6162"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-20T16:22:33Z",
"nvd_published_at": "2024-06-20T15:15:50Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as \"404 Not Found\" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.",
"id": "GHSA-9442-gm4v-r222",
"modified": "2026-02-27T21:38:27Z",
"published": "2024-06-20T15:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6162"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/pull/1612"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/commit/90f202ada89b6d9883beed0f1fe10c99d470d9a8"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/commit/a28ac53076e2fa532266d25e0c0b1a01d0e9d2cf"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1194"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4386"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4884"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-6162"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293069"
},
{
"type": "PACKAGE",
"url": "https://github.com/undertow-io/undertow"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/releases/tag/2.2.33.Final"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/releases/tag/2.3.14.Final"
},
{
"type": "WEB",
"url": "https://issues.redhat.com/browse/JBEAP-26268"
},
{
"type": "WEB",
"url": "https://issues.redhat.com/browse/UNDERTOW-2334"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Undertow\u0027s url-encoded request path information can be broken on ajp-listener"
}
GHSA-947M-JHCV-94RP
Vulnerability from github – Published: 2024-10-10 09:30 – Updated: 2024-10-10 09:30In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.
{
"affected": [],
"aliases": [
"CVE-2024-7049"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-10T08:15:03Z",
"severity": "MODERATE"
},
"details": "In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.",
"id": "GHSA-947m-jhcv-94rp",
"modified": "2024-10-10T09:30:35Z",
"published": "2024-10-10T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7049"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
Mitigation
Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
Mitigation
In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.