CVE-2024-23679

Опубликовано: 19 янв. 2024

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

Ссылки

https://github.com/advisories/GHSA-4m5p-5w5w-3jcf
Third Party Advisory
https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff
Patch
https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4
Patch
https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842
Patch
https://github.com/enonic/xp/issues/9253
Issue Tracking
https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf
Patch
Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf
Third Party Advisory
https://github.com/advisories/GHSA-4m5p-5w5w-3jcf
Third Party Advisory
https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff
Patch
https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4
Patch
https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842
Patch
https://github.com/enonic/xp/issues/9253
Issue Tracking
https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf
Patch
Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:enonic:xp:*:*:*:*:*:*:*:*

Версия до 7.7.4 (исключая)

cpe:2.3:a:enonic:xp:7.8.0:beta1:*:*:*:*:*:*

cpe:2.3:a:enonic:xp:7.8.0:beta2:*:*:*:*:*:*

cpe:2.3:a:enonic:xp:7.8.0:beta3:*:*:*:*:*:*

cpe:2.3:a:enonic:xp:7.8.0:rc1:*:*:*:*:*:*

cpe:2.3:a:enonic:xp:7.8.0:rc2:*:*:*:*:*:*

cpe:2.3:a:enonic:xp:7.8.0:rc3:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01219

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-384

Связанные уязвимости

GHSA-4m5p-5w5w-3jcf