Rule Definition
When non-serializable object is stored as an HttpSessionState attribute, it can damage application reliablity. ASP.NET servers by default store the HttpSessionState object, its attributes and any objects they reference in memory which limits active session state to what can be accommodated by the system memory. Servers are configured to persistent session state to expand capacity. The server must serialize the HttpSessionState object to persist its session state.

Remediation
All the objects which are stored as session attributes in the application must declare [Serializable] attribute to serialize the session correctly.

Violation Code Sample

HttpContext.Current.Session[CURRENT_USER_KEY] = value; 
 
this.Session.Add("lbSection", (string)((LinkButton)sender).ID.ToString());

_________________________________________________________

public class DataGlob {
   String GlobName;
   String GlobValue;

   public void AddToSession(HttpSessionState session) {
     session["glob"] = this;
   }
}

Fixed Code Sample

[Serializable]
public class EqueryRaised
{
#region Private Fields
private string _queryID;
private string _reOpenID;
}
________________________________________________________

[Serializable]
public class DataGlob {
   String GlobName;
   String GlobValue;

   public void AddToSession(HttpSessionState session) {
     session["glob"] = this;
   }
}

https://cwe.mitre.org/data/definitions/502.html