Lucene search
PRIOn knowledge basePRION:CVE-2024-23679HistoryJan 19, 2024 - 9:15 p.m.
Session fixation
2024-01-1921:15:00
PRIOn knowledge base
www.prio-n.com
3
enonic xp
session fixation
vulnerability
remote attacker
unauthenticated
session attributes
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.
| CPE | Name | Operator | Version |
|---|---|---|---|
| xp | lt | 7.7.4 | |
| xp | eq | 7.8.0 rc2 | |
| xp | eq | 7.8.0 rc3 | |
| xp | eq | 7.8.0 beta1 | |
| xp | eq | 7.8.0 beta2 | |
| xp | eq | 7.8.0 beta3 | |
| xp | eq | 7.8.0 rc1 |
References
github.com/advisories/GHSA-4m5p-5w5w-3jcf
github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff
github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4
github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842
github.com/enonic/xp/issues/9253
github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf
vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf
Related
osv
osv
CVE-2024-23679
2024-01-19 21:15:10
com.enonic.xp:lib-auth vulnerable to Session Fixation
2022-10-12 20:13:46
Session fixation in Enonic XP
2024-01-19 21:30:36
nvd
nvd
CVE-2024-23679
2024-01-19 21:15:10
cve
cve
CVE-2024-23679
2024-01-19 21:15:10
cvelist
cvelist
CVE-2024-23679 Enonic XP Session Fixation Vulnerability
2024-01-19 20:23:03
github
github
Session fixation in Enonic XP
2024-01-19 21:30:36