GHSA-4hrp-m3f2-643j

    Dashboard / Vulnerabilities / GHSA-4hrp-m3f2-643j

    GHSA-4hrp-m3f2-643j

    Published: 19 Jan 2024Last Modified: 10 Sept 2026

    Summary: Duplicate Advisory: Session fixation in Enonic XP

    Details: ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4m5p-5w5w-3jcf. This link is maintained to preserve external references. ## Original Description Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

    References: https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf, https://nvd.nist.gov/vuln/detail/CVE-2024-23679, https://github.com/enonic/xp/issues/9253, https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff, https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4, https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842, https://github.com/advisories/GHSA-4m5p-5w5w-3jcf, https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf

    Affected packages

    Package

    Name: com.enonic.xp:lib-auth

    Purl: pkg:maven/com.enonic.xp/lib-auth

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -7.7.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-4hrp-m3f2-643j | CVE-DB