SESSION MANAGEMENT (SMQ)
Salim can bypass session management because it is not applied comprehensively and consistently across the application
Salim can bypass session management because it is not applied comprehensively and consistently across the application
OWASP SCP
58
OWASP ASVS
1.1.6,3.7.1
OWASP AppSensor
CAPEC
-
SAFECODE
14,28
Every part of the application and type of request should verify that the user has a valid current session (if required) and thus their privileges, before undertaking any other data validation and processing.
NB: This relates to application-wide session management control. See SM K for what session management routines to use.
Mappings
OWASP ASVS (4.0): 1.1.6 ,3.7.1
Capec: 21
OWASP SCP: 58
OWASP Appsensor:
Safecode: 14,28
ASVS (4.0) Cheatsheetseries Index
ASVS V1.1 - Secure Software Development Lifecycle Requirements
ASVS V3.7 - Defenses Against Session Management Exploits
No suitable mappings were found.
Attacks
Password Guessing/Brute Force Attacks
