CWE

Common Weakness Enumeration

Celebrating 20 years of community-developed cybersecurity weakness knowledge!
New to CWE? click here!
CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE-613: DEPRECATED: Insufficient Session Expiration (5.0)  
ID

CWE-613: DEPRECATED: Insufficient Session Expiration

Weakness ID: 613
Vulnerability Mapping: PROHIBITED This CWE ID must not be used to map to real-world vulnerabilities
Abstraction: Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
View customized information:
Shows the description and diagram, platforms, mitigations, consequences, relationships, memberships, and content history. For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.
×

Edit Custom Filter


+ Description
This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
+ Vulnerability Mapping Notes
Usage PROHIBITED
(this CWE ID must not be used to map to real-world vulnerabilities)
Reason Deprecated

Rationale

This CWE has been deprecated.

Comments

See description and name for possible suggestions of other CWEs to consider.

Suggestions

CWE-ID Comment
CWE-1463 Insufficient Session Timeout Value
CWE-1464 Improper Session Invalidation
+ Notes

Maintenance

Version: 5.0; Release Date: 2026-10-27

This CWE entry has been deprecated. For many years, the intention and usage of this CWE entry has evolved to include many notions of "sessions" that are not specific to the web. Instead of expanding the scope of this entry, it was split into multiple separate entries. The original WASC-47 entry [REF-1520] includes considerations forcing re-authentication for "inactivity" (expiring sessions after a period of inactivity) versus "absolute" (a fixed expiration time), with a goal to "keep the lifespan of a session ID as short as possible." However, this CWE was also used for situations in which a session is not fully invalidated or terminated upon logout, which is a different weakness than the original intention for this entry. There is also evidence that this CWE entry was used for session fixation (CWE-384).
+ Content History
+ Submissions
Submission Date Submitter Organization
2007-05-07
(CWE Draft 6, 2007-05-07) 		WASC
+ Modifications
Modification Date Modifier Organization
2026-10-28
(CWE 5.0, 2026-10-28) 		CWE Content Team MITRE
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Maintenance_Notes, Mapping_Notes, Modes_of_Introduction, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type, Weakness_Ordinalities
2026-04-30
(CWE 4.20, 2026-04-30) 		CWE Content Team MITRE
updated Maintenance_Notes, Mapping_Notes, Observed_Examples, References
2025-12-11
(CWE 4.19, 2025-12-11) 		CWE Content Team MITRE
updated Applicable_Platforms, Relationships, Weakness_Ordinalities
2023-06-29
(CWE 4.12, 2023-06-29) 		CWE Content Team MITRE
updated Mapping_Notes
2023-04-27
(CWE 4.11, 2023-04-27) 		CWE Content Team MITRE
updated Detection_Factors, Relationships
2021-10-28
(CWE 4.6, 2021-10-28) 		CWE Content Team MITRE
updated Relationships
2020-02-24
(CWE 4.0, 2020-02-24) 		CWE Content Team MITRE
updated Relationships
2019-06-20
(CWE 3.3, 2019-06-20) 		CWE Content Team MITRE
updated Relationships
2018-03-27
(CWE 3.1, 2018-03-27) 		CWE Content Team MITRE
updated Relationships
2017-11-08
(CWE 3.0, 2017-11-08) 		CWE Content Team MITRE
updated Modes_of_Introduction, Relationships
2014-07-30
(CWE 2.8, 2014-07-31) 		CWE Content Team MITRE
updated Relationships
2014-06-23
(CWE 2.7, 2014-06-23) 		CWE Content Team MITRE
updated Relationships
2012-10-30
(CWE 2.3, 2012-10-30) 		CWE Content Team MITRE
updated Potential_Mitigations
2012-05-11
(CWE 2.2, 2012-05-15) 		CWE Content Team MITRE
updated Relationships
2011-06-01
(CWE 1.13, 2011-06-01) 		CWE Content Team MITRE
updated Common_Consequences
2010-09-27
(CWE 1.10, 2010-09-27) 		CWE Content Team MITRE
updated Taxonomy_Mappings
2010-02-16
(CWE 1.8, 2010-02-16) 		CWE Content Team MITRE
updated Taxonomy_Mappings
2009-03-10
(CWE 1.3, 2009-03-10) 		CWE Content Team MITRE
updated Relationships
2008-09-08
(CWE 1.0, 2008-09-09) 		CWE Content Team MITRE
updated Relationships, Other_Notes, Taxonomy_Mappings
2008-07-01
(CWE 1.0, 2008-09-09) 		Sean Eidemiller Cigital
added/updated demonstrative examples
2008-07-01
(CWE 1.0, 2008-09-09) 		Eric Dalci Cigital
updated Potential_Mitigations, Time_of_Introduction
+ Previous Entry Names
Change Date Previous Entry Name
2026-10-28 Insufficient Session Expiration
Page Last Updated: Oct 28, 2026
 

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.