CWE-6—J2EE Misconfiguration: Insufficient Session-ID Length

名称

J2EE Misconfiguration: Insufficient Session-ID Length

描述

The J2EE application is configured to use an insufficient session ID length.

If an attacker can guess or steal a session ID, then they may be able to take over the user's session (called session hijacking). The number of possible session IDs increases with increased session ID length, making it more difficult to guess or steal a session ID.

常见后果

范围：

Access Control

影响：

Gain Privileges or Assume Identity

注释：

If an attacker can guess an authenticated user's session identifier, they can take over the user's session.

相关 CWE

• CWE-334Small Space of Random Values