DerScanner
Home / Vulnerability Database / Go : Broken authentication and session management
Go

Go : Broken authentication and session management

Classification

OWASP Top 10 2013
A2-Broken Authentication and Session Management
OWASP Top 10 2017
A2-Broken Authentication
OWASP Top 10 2021
A7-Identification and Authentication Failures
OWASP ASVS
Session Management
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (e)(1)
CWE
CWE-1028

Overview

Application functions related to authentication and session management are insecure. This can lead to session hijacking and session fixation.

For example, application includes session ID into the URL or uses hardcoded authentication key.

References

  1. OWASP Top 10 2017 A2-Broken Authentication
  2. CWE-384: Session Fixation
  3. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
MEDIUM

DerScanner Severity Score

Do you want to fix Go : Broken authentication and session management in your application?

See also

Go

Go : Undocumented feature: special account

Go

Go : Nil salt

Go

Go : Logging into system output