CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
We have discovered 5,974 live websites that are affected by CWE-613.
CVEs
- Count - 8
CWE References
CWE-613 usage by Country
 United States | 4,377 websites |
 Germany | 237 websites |
 GB | 170 websites |
 Singapore | 121 websites |
 France | 116 websites |
 Netherlands | 84 websites |
 Canada | 80 websites |
 Australia | 77 websites |
 Turkey | 70 websites |
 Qatar | 64 websites |
CWE-613 usage by TLD
| .com | 2,858 websites |
| .org | 953 websites |
| .net | 145 websites |
| .ca | 124 websites |
| .co.uk | 123 websites |
| .com.au | 123 websites |
| .de | 116 websites |
| .edu | 86 websites |
| .io | 57 websites |
| .it | 55 websites |
Newest CVEs
List of the most recent CVEs that are part of CWE-613| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Jan, 2025 | CVE-2024-11627 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.Thi... | 4,527 |
| Feb, 2024 | CVE-2024-25619 | Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon | 104 |
| Jan, 2024 | CVE-2024-22403 | OAuth2 authorization codes are valid indefinetly in Nextcloud server | 195 |
| Jan, 2023 | CVE-2022-46177 | Discourse password reset link can lead to in account takeover if user changes to a new email | 1,134 |
| Nov, 2022 | CVE-2022-39234 | user session persists even after permanently deleting account in GLPI | 7 |
| Jun, 2022 | CVE-2022-31050 | Insufficient Session Expiration in TYPO3 Admin Tool | 2 |
| Jan, 2021 | CVE-2020-15220 | Session fixation | 5 |
| Jan, 2021 | CVE-2020-15218 | Admin pages are cached and can be embedded | 5 |
The most widespread CVEs
List of the most common CVEs that are part of CWE-613| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Jan, 2025 | CVE-2024-11627 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.Thi... | 4,527 |
| Jan, 2023 | CVE-2022-46177 | Discourse password reset link can lead to in account takeover if user changes to a new email | 1,134 |
| Jan, 2024 | CVE-2024-22403 | OAuth2 authorization codes are valid indefinetly in Nextcloud server | 195 |
| Feb, 2024 | CVE-2024-25619 | Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon | 104 |
| Nov, 2022 | CVE-2022-39234 | user session persists even after permanently deleting account in GLPI | 7 |
| Jan, 2021 | CVE-2020-15218 | Admin pages are cached and can be embedded | 5 |
| Jan, 2021 | CVE-2020-15220 | Session fixation | 5 |
| Jun, 2022 | CVE-2022-31050 | Insufficient Session Expiration in TYPO3 Admin Tool | 2 |
Websites affected by CWE-613
Top websites that are affected by CWE-613. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| *********.net | United States | *,*** | |
| ***.gov | United States | *,*** | |
| *********.***.com | France | *,*** | |
| **************.com | United States | *,*** | |
| *******.org | United States | **,*** | |
| ***********.org | United States | **,*** | |
| ********.org | United States | **,*** | |
| ************.org | United States | **,*** | |
| ***.org | United States | **,*** | |
| ***.org | United States | **,*** |