What’s Vulnerable › Vulnerabilities

CVE-2024-23679: Enonic XP Session Fixation Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-19 · updated 2026-07-14
• Weakness: CWE-384

Description

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

Affected products

• Enonic Xp: before 7.7.4; 7.8.0-beta1, 7.8.0-beta2, 7.8.0-beta3, 7.8.0-rc1, 7.8.0-rc2, 7.8.0-rc3 — fixed in 7.7.4

How to fix

Upgrade to a fixed version: Enonic Xp 7.7.4. Check the vendor advisory for mitigations.

References

• https://github.com/advisories/GHSA-4m5p-5w5w-3jcf
• https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff
• https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4
• https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842
• https://github.com/enonic/xp/issues/9253
• https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf
• https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf
• https://github.com/advisories/GHSA-4m5p-5w5w-3jcf
• https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff
• https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4
• https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842
• https://github.com/enonic/xp/issues/9253

Get alerted when CVE-2024-23679 or the next vulnerability affects your stack