CWE-613 不充分的会话过期机制 类弱点 414 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-613 属于会话管理缺陷，指网站允许攻击者重用过期的会话凭据或会话 ID 进行授权。攻击者通常通过窃取或猜测旧会话令牌，在合法会话结束后继续访问受保护资源，从而绕过身份验证。开发者应确保会话在用户主动注销、超时或敏感操作后及时失效，并实施严格的会话 ID 轮换机制，防止旧令牌被复用，以保障系统安全。
<web-app> [...snipped...] <session-config> <session-timeout>-1</session-timeout> </session-config> </web-app>| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-31140 | OpenProject 代码问题漏洞 — openproject | 4.8 | Medium | 2023-05-08 |
| CVE-2020-4914 | IBM Cloud Pak System 代码问题漏洞 — Cloud Pak System Software Suite | 4.2 | Medium | 2023-05-05 |
| CVE-2022-38707 | IBM Cognos Analytics 代码问题漏洞 — Cognos Command Center | 4.0 | Medium | 2023-05-05 |
| CVE-2023-28003 | Schneider Electric EcoStruxure Power Monitoring Expert 代码问题漏洞 — EcoStruxure Power Monitoring Expert | 6.7 | Medium | 2023-04-18 |
| CVE-2023-1854 | Online Graduate Tracer System 代码问题漏洞 — Online Graduate Tracer System | 4.7 | Medium | 2023-04-05 |
| CVE-2023-1788 | firefly-iii 代码问题漏洞 — firefly-iii/firefly-iii | 9.8 | - | 2023-04-05 |
| CVE-2021-3844 | Rapid7 InsightVM 代码问题漏洞 — InsightVM | 5.7 | Medium | 2023-03-24 |
| CVE-2023-1543 | answer 代码问题漏洞 — answerdev/answer | 9.8 | - | 2023-03-21 |
| CVE-2023-22591 | IBM Robotic Process Automation 代码问题漏洞 — Robotic Process Automation | 3.9 | Low | 2023-03-15 |
| CVE-2023-23929 | vantage6 代码问题漏洞 — vantage6 | 8.8 | High | 2023-03-03 |
| CVE-2022-48317 | Checkmk 代码问题漏洞 — Checkmk | 5.6 | Medium | 2023-02-20 |
| CVE-2023-25562 | DataHub 代码问题漏洞 — datahub | 6.9 | Medium | 2023-02-10 |
| CVE-2022-34392 | Dell SupportAssist for Home PCs 代码问题漏洞 — SupportAssist | 5.5 | Medium | 2023-02-10 |
| CVE-2023-23614 | Pi-hole 代码问题漏洞 — AdminLTE | 8.8 | High | 2023-01-26 |
| CVE-2023-22732 | Shopware 代码问题漏洞 — platform | 3.7 | Low | 2023-01-17 |
| CVE-2023-0227 | pyload 代码问题漏洞 — pyload/pyload | 9.8 | - | 2023-01-12 |
| CVE-2023-22492 | ZITADEL 代码问题漏洞 — zitadel | 5.9 | Medium | 2023-01-11 |
| CVE-2022-46177 | Discourse 代码问题漏洞 — discourse | 5.7 | Medium | 2023-01-05 |
| CVE-2022-43844 | IBM Robotic Process Automation 代码问题漏洞 — Robotic Process Automation for Cloud Pak | 8.1 | - | 2023-01-05 |
| CVE-2022-22371 | IBM Sterling B2B Integrator 代码问题漏洞 — Sterling B2B Integrator Standard Edition | 5.5 | Medium | 2023-01-04 |
| CVE-2022-23502 | TYPO3 代码问题漏洞 — typo3 | 5.4 | Medium | 2022-12-14 |
| CVE-2022-40228 | IBM DataPower Gateway 代码问题漏洞 — DataPower Gateway | 3.7 | Low | 2022-11-22 |
| CVE-2022-4070 | LibreNMS 代码问题漏洞 — librenms/librenms | 9.8 | - | 2022-11-20 |
| CVE-2022-3362 | Rdiffweb 代码问题漏洞 — ikus060/rdiffweb | 9.8 | - | 2022-11-14 |
| CVE-2022-3867 | HashiCorp Nomad 代码问题漏洞 — Nomad | 2.7 | Low | 2022-11-10 |
| CVE-2022-39234 | GLPI 代码问题漏洞 — glpi | 4.7 | Medium | 2022-11-03 |
| CVE-2022-41672 | Apache Airflow 代码问题漏洞 — Apache Airflow | 8.1 | - | 2022-10-07 |
| CVE-2022-2888 | OctoPrint 代码问题漏洞 — octoprint/octoprint | 4.4 | - | 2022-09-21 |
| CVE-2022-2713 | Cockpit 代码问题漏洞 — cockpit-hq/cockpit | 9.8 | - | 2022-08-08 |
| CVE-2022-35728 | F5 BIG-IP 代码问题漏洞 — BIG-IP | 8.1 | High | 2022-08-04 |
CWE-613（不充分的会话过期机制） 是常见的弱点类别，本平台收录该类弱点关联的 414 条 CVE 漏洞。