PT-2022-28162 · Enonic · Enonic Xp

Rymsha · Published 2022-10-12 · Updated 2025-11-29 · CVE-2024-23679

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enonic XP versions less than 7.7.4

Description The issue is a session fixation problem that allows a remote and unauthenticated attacker to use prior sessions due to the lack of invalidating session attributes. This affects all id-providers using the lib-auth login method.

Recommendations For Enonic XP versions less than 7.7.4, consider updating to version 7.7.4 or later to resolve the issue. As a temporary workaround, avoid using lib-auth for login, and instead use the Java API, which allows for invalidating previous sessions before auth-info is added.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2024-23679

GHSA-4HRP-M3F2-643J

GHSA-4M5P-5W5W-3JCF

Affected Products

Enonic Xp

References · 15

• https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff · Patch
• https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4 · Patch
• https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 · Patch
• https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23679 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hrp-m3f2-643j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23679 · Security Note
• https://osv.dev/vulnerability/GHSA-4m5p-5w5w-3jcf · Vendor Advisory
• https://github.com/enonic/xp/issues/9253 · Note
• https://github.com/enonic/xp · Note
• https://github.com/advisories/GHSA-4m5p-5w5w-3jcf · Note
• https://twitter.com/CVEnew/status/1748442356628725949 · Twitter Post
• https://t.me/cveNotify/144313 · Telegram Post
• https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf · Note
• https://t.me/cvenotify/68951 · Telegram Post