CWE-613 不充分的会话过期机制 类弱点 414 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-613 属于会话管理缺陷，指网站允许攻击者重用过期的会话凭据或会话 ID 进行授权。攻击者通常通过窃取或猜测旧会话令牌，在合法会话结束后继续访问受保护资源，从而绕过身份验证。开发者应确保会话在用户主动注销、超时或敏感操作后及时失效，并实施严格的会话 ID 轮换机制，防止旧令牌被复用，以保障系统安全。
<web-app> [...snipped...] <session-config> <session-timeout>-1</session-timeout> </session-config> </web-app>| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-4643 | Payload 代码问题漏洞 — Payload | 9.1 | - | 2025-08-29 |
| CVE-2024-41985 | Siemens多款产品 代码问题漏洞 — SmartClient modules Opcenter QL Home (SC) | 2.6 | Low | 2025-08-12 |
| CVE-2025-36040 | IBM Aspera Faspex 代码问题漏洞 — Aspera Faspex | 6.5 | Medium | 2025-07-30 |
| CVE-2025-31952 | HCL iAutomate 安全漏洞 — iAutomate | 7.1 | High | 2025-07-24 |
| CVE-2024-27779 | Fortinet FortiSandbox和Fortinet FortiIsolator 代码问题漏洞 — FortiSandbox | 6.3 | Medium | 2025-07-18 |
| CVE-2025-53642 | HAXcms with nodejs backend 代码问题漏洞 — issues | 4.8 | Medium | 2025-07-11 |
| CVE-2025-4407 | ABB Lite Panel Pro 代码问题漏洞 — Lite Panel Pro | 6.7 | Medium | 2025-06-30 |
| CVE-2025-49152 | MICROSENS NMP Web+ 代码问题漏洞 — NMP Web+ | 9.8AI | Critical AI | 2025-06-25 |
| CVE-2025-4754 | Ash Authentication Phoenix 安全漏洞 — ash_authentication_phoenix | 2.3 | Low | 2025-06-17 |
| CVE-2024-50562 | Fortinet FortiOS SSL-VPN 代码问题漏洞 — FortiOS | 4.4 | Medium | 2025-06-10 |
| CVE-2025-25019 | IBM Cloud Pak for Security和IBM QRadar Suite 代码问题漏洞 — QRadar Suite Software | 4.8 | Medium | 2025-06-03 |
| CVE-2025-33005 | IBM Planning Analytics Local 代码问题漏洞 — Planning Analytics Local | 6.3 | Medium | 2025-06-01 |
| CVE-2025-48061 | wire-webapp 安全漏洞 — wire-webapp | 5.6 | Medium | 2025-05-22 |
| CVE-2025-0138 | Palo Alto Networks Prisma Cloud Compute Edition 安全漏洞 — Prisma Cloud Compute Edition | 9.4AI | Critical AI | 2025-05-14 |
| CVE-2025-40566 | Siemens SIMATIC PCS neo 代码问题漏洞 — SIMATIC PCS neo V4.1 | 8.8 | High | 2025-05-13 |
| CVE-2025-46741 | Schweitzer Engineering Laboratories多款产品 安全漏洞 — SEL Blueframe OS | 5.7 | Medium | 2025-05-12 |
| CVE-2025-4528 | Dígitro NGC Explorer 代码问题漏洞 — NGC Explorer | 4.3 | Medium | 2025-05-11 |
| CVE-2025-46815 | ZITADEL 安全漏洞 — zitadel | 8.0 | High | 2025-05-06 |
| CVE-2025-46344 | nextjs-auth0 代码问题漏洞 — nextjs-auth0 | 9.1AI | Critical AI | 2025-04-29 |
| CVE-2025-2185 | ALBEDO Telecom Net.Time - PTP/NTP clock 代码问题漏洞 — Net.Time - PTP/NTP clock (Serial No. NBC0081P) | 8.0 | High | 2025-04-24 |
| CVE-2021-47663 | Franka Emika Robot 代码问题漏洞 — Franka Emika Robot | 8.1 | High | 2025-04-24 |
| CVE-2024-22351 | IBM InfoSphere Information Server 代码问题漏洞 — InfoSphere Information Server | 6.3 | Medium | 2025-04-23 |
| CVE-2025-42602 | Meon KYC 授权问题漏洞 — KYC solutions | 9.1 | - | 2025-04-23 |
| CVE-2024-45651 | IBM Sterling Connect:Direct Web Services 代码问题漏洞 — Sterling Connect:Direct Web Services | 6.3 | Medium | 2025-04-18 |
| CVE-2024-49825 | IBM Robotic Process Automation 代码问题漏洞 — Robotic Process Automation | 6.3 | Medium | 2025-04-14 |
| CVE-2025-24859 | Apache Roller 代码问题漏洞 — Apache Roller | 8.8AI | High AI | 2025-04-14 |
| CVE-2025-30516 | Mattermost Mobile Apps 安全漏洞 — Mattermost | 2.0 | Low | 2025-04-14 |
| CVE-2025-1968 | Progress Sitefinity 代码问题漏洞 — Sitefinity | 7.7 | High | 2025-04-09 |
| CVE-2024-25051 | IBM Jazz Reporting Service 代码问题漏洞 — Jazz Reporting Service | 6.6 | Medium | 2025-04-02 |
| CVE-2025-2596 | Checkmk 安全漏洞 — Checkmk | 7.1AI | High AI | 2025-03-26 |
CWE-613（不充分的会话过期机制） 是常见的弱点类别，本平台收录该类弱点关联的 414 条 CVE 漏洞。