Loading HuntDB...

Improper Cookie expiration | Cookies Expiration Set to Future

Low
W
Weblate
Submitted None
Reported by sadhu16

Vulnerability Details

Technical details and impact analysis

Hi Team, I have found at many instances or places from signup till getting logged into application ( in domain "demo.weblate.org" ) that session maintaining cookies such as csrf token and session id's expiration dates are set to future date. As part of secure session management one should prohibit or avoid the use of persistent cookies specially for those cookies which contain sensitive information.Ideally application should use only cookies of non persistent nature. Here Application is setting cookie expiration to future date. Here an adversary may get an access to victim's cookies (session ids and csrf token ) and can reuse them in further getting valid session on behalf of them or he can directly use them for any activity which cause harm to victims. Attached screenshots for reference please see them. See the below mentioned link for details: https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OTG-SESS-002)

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted