We recall the CBC mode of encryption of a message $M=M_{1}M_{2}M_{3}\ldots M_{n}$ , where $M_{i}$ is block number $i$ of $M$ . Then the encrypted message is $C_{0}C_{1}C_{2}\ldots C_{n}$ , where

C_{0} = IVC_{i} = E_{K}(M_{i}\oplus C_{i-1}),\quad i=1,2,\ldots n.

Now we consider the following beginning of a protocol:

$A\longrightarrow B:N_{A}$
$B\longrightarrow A:\{N_{A},K\}_{K_{AB}}$ .
We do not need to know more about the protocol (which may contain further messages) than the following:

$A$ and $B$ share a long-term AES key $K_{AB}$ ; the notation $\{\ldots\}_{K_{AB}}$ denotes encryption of $\ldots$ using AES in CBC mode (block size 128 bits).
$N_{A}$ is a 128 bit nonce chosen by $A$ and $K$ is a 128 bit session key chosen by $B$ .
In the second message, $B$ includes $N_{A}$ to ensure freshness and $K$ as a session key for the session just started. When $A$ receives the second message, she thus concludes that $B$ is alive at the other end and has just chosen a fresh session key $K$ .
Now consider the following scenario: The adversary $C$ eavesdrops on a run of this protocol between $A$ and $B$ and stores messages sent. Because of an unspecified mistake by $A$ or $B$ (outside the protocol), $C$ gets hold of $K$ and can of course read all subsequent messages in the session. But, the situation is worse than that, as we shall see.
Let message 2 in the run described above be $C_{0}C_{1}C_{2}$ (three blocks; the $IV$ and two encrypted blocks).
The next day, $A$ and $B$ initiate a new session. $C$ again eavesdrops and now intercepts the second message $C_{0}^{\prime}C_{1}^{\prime}C_{2}^{\prime}$ , changes it to $C_{0}^{\prime}C_{1}^{\prime}C_{2}$ and sends the changed message to $A$ , pretending to be $B$ .