Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-23679 Details

Description

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/advisories/GHSA-4m5p-5w5w-3jcf CVEThird Party Advisory
https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff CVEPatch
https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4 CVEPatch
https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 CVEPatch
https://github.com/enonic/xp/issues/9253 CVEIssue Tracking

see all 14 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-384Session Fixation[email protected]
CWE-384Session Fixation[email protected]

Affected Products

ProductVersions
enonic xp
< 7.7.4
7.8.0 beta1
7.8.0 beta2
7.8.0 beta3
7.8.0 rc1

CPE

  • cpe:2.3:a:enonic:xp:*:*:*:*:*:*:*:*
  • cpe:2.3:a:enonic:xp:7.8.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:enonic:xp:7.8.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:enonic:xp:7.8.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:enonic:xp:7.8.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:enonic:xp:7.8.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:enonic:xp:7.8.0:rc3:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

9 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-23679
NVD Published Date:
Jan 19, 2024
NVD Last Modified:
Jul 14, 2026
Source:
[email protected]
CVE-2024-23679 Details - Not Deferred