If session timeouts are set to long durations, sessions remain valid longer than intended. This vulnerability is referred to as:

If session timeouts are set to long durations, sessions remain valid longer than intended. This vulnerability is referred to as:

• A. CRLF Injection
• B. Broken Authentication
• C. XML External Entity Attack
• D. Timeout Exploitation

Answer: (D)

This item tests how session management weaknesses arise from overly long timeouts. When session timeouts are extended, a valid session can remain active far longer than intended, giving an attacker a larger window to reuse that session if a user’s device is left unattended, stolen, or accessed by others. This is described as Timeout Exploitation—the attacker exploits the extended validity period of a session token to misuse the authenticated session. For context, other terms refer to different issues: CRLF Injection involves manipulating HTTP headers; XML External Entity Attack targets XML parsers to access local files or cause other effects; Broken Authentication covers general weaknesses in authentication and session handling, but the specific risk described here centers on the impact of long timeouts on session validity. To mitigate, enforce reasonable session lifetimes, implement idle timeouts, invalidate sessions on logout, and require re-authentication for sensitive actions.

This item tests how session management weaknesses arise from overly long timeouts. When session timeouts are extended, a valid session can remain active far longer than intended, giving an attacker a larger window to reuse that session if a user’s device is left unattended, stolen, or accessed by others. This is described as Timeout Exploitation—the attacker exploits the extended validity period of a session token to misuse the authenticated session.

For context, other terms refer to different issues: CRLF Injection involves manipulating HTTP headers; XML External Entity Attack targets XML parsers to access local files or cause other effects; Broken Authentication covers general weaknesses in authentication and session handling, but the specific risk described here centers on the impact of long timeouts on session validity. To mitigate, enforce reasonable session lifetimes, implement idle timeouts, invalidate sessions on logout, and require re-authentication for sensitive actions.