CWE-6— J2EE Misconfiguration: Insufficient Session-ID Length

The J2EE application is configured to use an insufficient session ID length.— MITRE CWE catalog

1 active CVE classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-6page 1 of 1

CVE-2018-12538HIGHCVSS 8.8EG 8.8
2018-06-22
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even dele…

Map vulnerabilities like CWE-6 to your infrastructure

EchelonGraph correlates every CVE — across CWE-6 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →