CVE-2024-23679

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-23679
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23679.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-23679
Aliases
Published
2024-01-19T20:23:03.781Z
Modified
2026-07-16T03:31:01.115410856Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Enonic XP Session Fixation Vulnerability
Details

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23679.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-384"
    ]
}
References

Affected packages

Git / github.com/enonic/xp

Affected ranges

Type
GIT
Repo
https://github.com/enonic/xp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3638214d55b50fa4812343db9ef51121bf0fc002
Introduced
3ac04800230e9d69449c5cbe5a689372e2d5e26e
Fixed
0189975691e9e6407a9fee87006f730e84f734ff
Fixed
1f44674eb9ab3fbab7103e8d08067846e88bace4
Fixed
2abac31cec8679074debc4f1fb69c25930e40842
Database specific 
{
    "cpe": [
        "cpe:2.3:a:enonic:xp:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:enonic:xp:7.8.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:enonic:xp:7.8.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:enonic:xp:7.8.0:rc3:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.7.4"
        },
        {
            "introduced": "7.8.0-rc1"
        },
        {
            "last_affected": "7.8.0-rc1"
        },
        {
            "introduced": "7.8.0-rc2"
        },
        {
            "last_affected": "7.8.0-rc2"
        },
        {
            "introduced": "7.8.0-rc3"
        },
        {
            "last_affected": "7.8.0-rc3"
        }
    ]
}

Affected versions

7.*
7.8.0-rc1
7.8.0-rc2
7.8.0-rc3
v5.*
v5.0.0
v5.0.1
v6.*
v6.0.0-M1
v6.0.0-RC1
v6.10.0
v6.10.0-B1
v6.10.0-RC2
v6.10.0-RC3
v6.12.0
v6.12.0-B1
v6.12.0-RC1
v6.12.0-RC2
v6.12.0-RC3
v6.13.0
v6.13.0-B1
v6.13.0-RC1
v6.13.0-RC2
v6.14.0
v6.14.0-B1
v6.14.0-B2
v6.14.0-RC1
v6.15.0
v6.15.0-B1
v6.15.0-B2
v6.15.0-RC1
v6.15.0-RC2
v6.15.0-RC3
v6.15.0-RC4
v6.2.0
v6.2.0-RC1
v6.2.0-RC2
v6.2.0-RC3
v6.2.0-RC4
v6.2.0-RC5
v6.3.0
v6.3.0-M1
v6.3.0-M2
v6.3.0-RC1
v6.3.0-RC2
v6.4.0-RC1
v6.5.0
v6.5.0-RC2
v6.5.0-RC3
v6.5.1
v6.7.0
v6.7.0-RC1
v6.7.0-RC2
v6.7.0-RC3
v6.7.0-RC4
v6.7.0-RC5
v6.7.0-RC6
v6.8.0
v6.8.0-B1
v6.8.0-B2
v6.8.0-RC1
v6.8.0-RC2
v6.9.0
v6.9.0-B1
v6.9.0-B2
v6.9.0-B3
v6.9.0-B4
v6.9.0-RC1
v6.9.0-RC2
v6.9.0-RC3
v7.*
v7.0.0
v7.0.0-A1
v7.0.0-A2
v7.0.0-A3
v7.0.0-B1
v7.0.0-B3
v7.0.0-B4
v7.0.0-B5
v7.0.0-RC1
v7.0.0-RC2
v7.0.0-RC3
v7.0.0-RC4
v7.0.0-RC5
v7.1.0
v7.1.0-B1
v7.1.0-B2
v7.1.0-B3
v7.1.0-RC1
v7.2.0
v7.2.0-B1
v7.2.0-B2
v7.2.0-RC1
v7.7.0
v7.7.0-B1
v7.7.0-B2
v7.7.0-RC1
v7.7.0-RC2
v7.7.0-RC3
v7.7.1
v7.7.1-B1
v7.7.1-RC1
v7.7.2
v7.7.2-RC1
v7.7.3
v7.7.3-RC1
v7.7.3-RC2
v7.7.4-RC1
v7.8.0-B1
v7.8.0-B2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23679.json"