Web Server Uses Non Random Session IDs

medium Nessus Plugin ID 31657

Language:

Synopsis

The remote web server generates predictable session IDs.

Description

The remote web server generates a session ID for each connection. A session ID is typically used to keep track of a user's actions while they visit a website. The remote server generates non-random session IDs. An attacker might use this flaw to guess the session IDs of other users and therefore steal their session.

Solution

Configure the remote site and CGIs to use random session IDs.

Plugin Details

Severity: Medium

ID: 31657

File Name: www_nonrandom_session_id.nasl

Version: 1.13

Type: remote

Family: Web Servers

Published: 3/26/2008

Updated: 5/25/2020

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Based on analysis of vulnerability

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: manual

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Detections

Analytics