CWE-488
AllowedExposure of Data Element to Wrong Session
Abstraction: Base · Status: Draft
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
81 vulnerabilities reference this CWE, most recent first.
GHSA-C5VX-CVPM-2HF5
Vulnerability from github – Published: 2026-10-07 06:33 – Updated: 2026-10-07 06:33A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they control, receives an access token obtained for a different remote, and can reuse it at the service that issued it. Content stored in Pulp is not changed, and the service is not stopped.
{
"affected": [],
"aliases": [
"CVE-2026-103869"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-07T06:16:35Z",
"severity": "MODERATE"
},
"details": "A flaw was found in pulp-ansible\u0027s bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they control, receives an access token obtained for a different remote, and can reuse it at the service that issued it. Content stored in Pulp is not changed, and the service is not stopped.",
"id": "GHSA-c5vx-cvpm-2hf5",
"modified": "2026-10-07T06:33:02Z",
"published": "2026-10-07T06:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103869"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-103869"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544603"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJP9-H6X7-98P3
Vulnerability from github – Published: 2025-03-26 21:31 – Updated: 2025-03-27 15:31An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid.
{
"affected": [],
"aliases": [
"CVE-2025-30073"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-26T20:15:22Z",
"severity": "HIGH"
},
"details": "An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid.",
"id": "GHSA-cjp9-h6x7-98p3",
"modified": "2025-03-27T15:31:06Z",
"published": "2025-03-26T21:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30073"
},
{
"type": "WEB",
"url": "https://www.syss.de/pentest-blog/businesslogik-fehler-bei-aufwertung-von-geldkarten-in-opcr-webapp-aufwertung-syss-2024-089"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F23P-VX2J-J53R
Vulnerability from github – Published: 2026-08-07 18:42 – Updated: 2026-08-07 18:42Summary
memo() from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request.
Details
Components wrapped with memo() are compared by props alone. Values read implicitly during rendering do not participate: JSX Context through createContext() and useContext(), useRequestContext() from hono/jsx-renderer, and getContext() from hono/context-storage. The retained result lives as long as the wrapped component, so it outlives the request that produced it.
Per-request context isolation is not what fails: the current request's values are established correctly, but the memoized component is skipped before anything reads them.
This issue arises when a component wrapped in memo() obtains user- or request-specific data from an ambient context instead of through props.
Impact
A user may receive a response containing HTML rendered for another user, when both render the same memoized component with comparator-equal props on the same warm instance.
This may lead to:
- Disclosure of another user's account or profile data
- Disclosure of request-scoped secrets embedded in HTML, such as CSRF tokens
- Exposure of role-specific content to users who should not receive it
Exploitation depends on the order in which renders populate the retained value and on both requests reaching the same warm instance.
This issue affects applications that render with hono/jsx on the server and wrap a component reading ambient request state in memo(). Applications that pass all request-specific values through props, or that do not use memo(), are unaffected. Client-side rendering is unaffected.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hono"
},
"ranges": [
{
"events": [
{
"introduced": "3.8.0"
},
{
"fixed": "4.12.34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-71850"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-07T18:42:01Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\n`memo()` from `hono/jsx` retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user\u0027s request.\n\n### Details\n\nComponents wrapped with `memo()` are compared by props alone. Values read implicitly during rendering do not participate: JSX Context through `createContext()` and `useContext()`, `useRequestContext()` from `hono/jsx-renderer`, and `getContext()` from `hono/context-storage`. The retained result lives as long as the wrapped component, so it outlives the request that produced it.\n\nPer-request context isolation is not what fails: the current request\u0027s values are established correctly, but the memoized component is skipped before anything reads them.\n\nThis issue arises when a component wrapped in `memo()` obtains user- or request-specific data from an ambient context instead of through props.\n\n### Impact\n\nA user may receive a response containing HTML rendered for another user, when both render the same memoized component with comparator-equal props on the same warm instance.\n\nThis may lead to:\n\n- Disclosure of another user\u0027s account or profile data\n- Disclosure of request-scoped secrets embedded in HTML, such as CSRF tokens\n- Exposure of role-specific content to users who should not receive it\n\nExploitation depends on the order in which renders populate the retained value and on both requests reaching the same warm instance.\n\nThis issue affects applications that render with `hono/jsx` on the server and wrap a component reading ambient request state in `memo()`. Applications that pass all request-specific values through props, or that do not use `memo()`, are unaffected. Client-side rendering is unaffected.",
"id": "GHSA-f23p-vx2j-j53r",
"modified": "2026-08-07T18:42:01Z",
"published": "2026-08-07T18:42:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f"
},
{
"type": "PACKAGE",
"url": "https://github.com/honojs/hono"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/releases/tag/v4.12.34"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure"
}
GHSA-H546-6X4H-W6Q7
Vulnerability from github – Published: 2025-10-22 18:30 – Updated: 2026-04-24 00:31Software which sets SO_REUSEPORT_LB on a socket and then connects it to a host will not directly observe any problems. However, due to its membership in a load-balancing group, that socket will receive packets originating from any host. This breaks the contract of the connect(2) and implied connect via sendto(2), and may leave the application vulnerable to spoofing attacks.
The kernel failed to check the connection state of sockets when adding them to load-balancing groups. Furthermore, when looking up the destination socket for an incoming packet, the kernel will match a socket belonging to a load-balancing group even if it is connected, in violation of the contract that connected sockets are only supposed to receive packets originating from the connected host.
{
"affected": [],
"aliases": [
"CVE-2025-24934"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-22T18:15:34Z",
"severity": "MODERATE"
},
"details": "Software which sets SO_REUSEPORT_LB on a socket and then connects it to a host will not directly observe any problems. However, due to its membership in a load-balancing group, that socket will receive packets originating from any host. This breaks the contract of the connect(2) and implied connect via sendto(2), and may leave the application vulnerable to spoofing attacks.\n\n\n\n\nThe kernel failed to check the connection state of sockets when adding them to load-balancing groups. Furthermore, when looking up the destination socket for an incoming packet, the kernel will match a socket belonging to a load-balancing group even if it is connected, in violation of the contract that connected sockets\u00a0are only supposed to receive packets originating from the connected host.",
"id": "GHSA-h546-6x4h-w6q7",
"modified": "2026-04-24T00:31:50Z",
"published": "2025-10-22T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24934"
},
{
"type": "WEB",
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-25:09.netinet.asc"
},
{
"type": "WEB",
"url": "https://www.usenix.org/system/files/conference/usenixsecurity26/sec26_prepub_ben-simhon.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H55G-WW3M-9HQ9
Vulnerability from github – Published: 2026-03-24 21:31 – Updated: 2026-09-18 18:31For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information in Zabbix documentation.
{
"affected": [],
"aliases": [
"CVE-2026-23919"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-24T19:16:49Z",
"severity": "HIGH"
},
"details": "For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information \u003ca href=\u0027https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe\u0027\u003ein Zabbix documentation\u003c/a\u003e.",
"id": "GHSA-h55g-ww3m-9hq9",
"modified": "2026-09-18T18:31:13Z",
"published": "2026-03-24T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23919"
},
{
"type": "WEB",
"url": "https://support.zabbix.com/browse/ZBX-27638"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HM8W-PXCF-MJ62
Vulnerability from github – Published: 2023-05-10 15:30 – Updated: 2024-04-04 03:59Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2022-40210"
],
"database_specific": {
"cwe_ids": [
"CWE-488",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T14:15:14Z",
"severity": "HIGH"
},
"details": "Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-hm8w-pxcf-mj62",
"modified": "2024-04-04T03:59:29Z",
"published": "2023-05-10T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40210"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00772.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MFVP-7P3V-X9MH
Vulnerability from github – Published: 2026-05-28 18:30 – Updated: 2026-07-02 18:37In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/casdoor/casdoor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1000.1-0.20260321120606-239e8bd69487"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-9098"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T18:37:59Z",
"nvd_published_at": "2026-05-28T17:16:34Z",
"severity": "CRITICAL"
},
"details": "In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.",
"id": "GHSA-mfvp-7p3v-x9mh",
"modified": "2026-07-02T18:37:59Z",
"published": "2026-05-28T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9098"
},
{
"type": "PACKAGE",
"url": "https://github.com/casdoor/casdoor"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/780781"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest"
}
GHSA-P4RQ-VWGG-386F
Vulnerability from github – Published: 2024-02-08 12:30 – Updated: 2026-05-20 12:30Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable.This issue affects MİA-MED: before 1.0.7.
{
"affected": [],
"aliases": [
"CVE-2023-6519"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-08T12:15:55Z",
"severity": "HIGH"
},
"details": "Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. M\u0130A-MED allows Read Sensitive Strings Within an Executable.This issue affects M\u0130A-MED: before 1.0.7.",
"id": "GHSA-p4rq-vwgg-386f",
"modified": "2026-05-20T12:30:35Z",
"published": "2024-02-08T12:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6519"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0087"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-0087"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P8F6-44XP-3CP8
Vulnerability from github – Published: 2026-09-07 18:31 – Updated: 2026-09-07 18:31In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
{
"affected": [],
"aliases": [
"CVE-2026-86492"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T17:17:27Z",
"severity": "HIGH"
},
"details": "In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens",
"id": "GHSA-p8f6-44xp-3cp8",
"modified": "2026-09-07T18:31:32Z",
"published": "2026-09-07T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86492"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PHG3-GV66-Q38X
Vulnerability from github – Published: 2025-02-13 15:31 – Updated: 2025-03-03 15:31A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest"
},
"ranges": [
{
"events": [
{
"introduced": "3.16.0.CR1"
},
{
"fixed": "3.18.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest-deployment"
},
"ranges": [
{
"events": [
{
"introduced": "3.16.0.CR1"
},
{
"fixed": "3.18.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest"
},
"ranges": [
{
"events": [
{
"introduced": "3.9.0.CR1"
},
{
"fixed": "3.15.3.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest-deployment"
},
"ranges": [
{
"events": [
{
"introduced": "3.9.0.CR1"
},
{
"fixed": "3.15.3.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.6.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-rest-deployment"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-1247"
],
"database_specific": {
"cwe_ids": [
"CWE-488"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-13T17:36:18Z",
"nvd_published_at": "2025-02-13T14:16:18Z",
"severity": "HIGH"
},
"details": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.",
"id": "GHSA-phg3-gv66-q38x",
"modified": "2025-03-03T15:31:24Z",
"published": "2025-02-13T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/issues/45789"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/d8df15cec17dc5d085efc372d77cbef1341ae071"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/f42166ee7041ed09b7183d5dbf3ece2439b16676"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:1884"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:1885"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:2067"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-1247"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
},
{
"type": "PACKAGE",
"url": "https://github.com/quarkusio/quarkus"
},
{
"type": "WEB",
"url": "https://quarkus.io/blog/cve-fixes-feb-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance"
}
Mitigation
Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
Mitigation
Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
Mitigation
In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.