DerScanner
Home / Vulnerability Database / Config files : Cookie: unlimited expiration time
Config files

Config files : Cookie: unlimited expiration time

Classification

OWASP Top 10 2013
A2-Broken Authentication and Session Management
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (a)(2)(iii)
CWE
CWE-539CWE-1028

Overview

The application uses persistent cookies. Storing valuable data in persistent cookies may result in loss of its confidentiality.

In most cases, cookies are non-persistent by default. That means cookies are not stored on disk and are deleted when the browser is closed. The developer can define certain cookies to be persistent, in which case they are written to disk and stored between browser and computer restarts.

If valuable data is stored in persistent cookies, an attacker has more time to get access to it.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2017 A2-Broken Authentication
  2. OWASP Top 10 2013-A5-Security Misconfiguration
  3. Origin Cookies: Session Integrity for Web Applications (pdf)
  4. Securing Session INI Settings - php.net
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
  6. CWE-539
LOW

DerScanner Severity Score

Do you want to fix Config files : Cookie: unlimited expiration time in your application?

See also

Config files

Config files : Text4Shell Vulnerability

Config files

Config files : Incorrect directory deletion

Config files

Config files : Code injection