← Back
CWE-384

424 CVEs • Abstraction: Compound

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

JSON object

Loading...

CVEs (424)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-3222
2Drupal
Fedoraproject
2Drupal
Fedora
Apr 23, 2026
Jul 18, 2008
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vector...Show more
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.Show less
CVE-2007-4188
1Joomla
1Joomla
Apr 23, 2026
Aug 8, 2007
N/A· v4
N/A· v3
9.3 HIGH· v2
Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unspecified vectors.
CVE-2001-1534
1Apache
1Http Server
Apr 16, 2026
Dec 31, 2001
N/A· v4
N/A· v3
2.1 LOW· v2
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass...Show more
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.Show less
CVE-1999-0428
1Openssl
1Openssl
Apr 16, 2026
Mar 22, 1999
N/A· v4
N/A· v3
7.5 HIGH· v2
OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.