General Information

Exposure of Data Element to Wrong Session via Data Race Condition

Variants:
Direct 

Also Known As:
Exposure of Data Element to Wrong Session, Singleton Member Field Race Condition, Shared Field Race Condition, Static Field Race Condition

Vector Type:
Attack

Relevance:
Generic

Layer:
Application-Level

Platforms:
Any

Target Type:
Application

Affected Mechanisms:
Synchronization, Session Management

Invented In:
01/01/1999

Added In:
25/12/2014


Vector Operation Method:
Private information can be leaked to unauthorized entities due to a race condition on access to a shared static variable or member fields, in components such as servlets. Typical instances result in exposure of data from one session to another due to flaws that derive from memory leaks, or the usage of static or persistent fields.


Direct Variant:

Member Field Race Condition

Also Known As:
Exposure of Data Element to Wrong Session via Data Race Condition

Typical Severity:
Major

Learn More: