← Back

CVE-2024-23679

nvd nist
Published: Jan 19, 2024Modified: Jul 14, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

Affected (7)

Products: Enonic: Xp
Enonic
1 product
Xp
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Enonic
Xp
Before 7.7.4
Xp
Version 7.8.0 beta1
Xp
Version 7.8.0 beta2
Xp
Version 7.8.0 beta3
Xp
Version 7.8.0 rc1
Xp
Version 7.8.0 rc2
Xp
Version 7.8.0 rc3

Related CWEs

CWE-384
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (14)

Source: disclosure@vulncheck.com
Third Party Advisory
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Issue Tracking
Source: disclosure@vulncheck.com
PatchVendor Advisory
Source: disclosure@vulncheck.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.