GHSA-4m5p-5w5w-3jcf

    Dashboard / Vulnerabilities / GHSA-4m5p-5w5w-3jcf

    GHSA-4m5p-5w5w-3jcf

    Published: 12 Oct 2022Last Modified: 8 Jul 2026

    Summary: com.enonic.xp:lib-auth vulnerable to Session Fixation

    Details: ### Impact All id-providers using lib-auth `login` method. ### Patches https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4 ### Workarounds Don't use lib-auth for `login`. Java API uses low-level structures and allows to invalidate previous session before auth-info is added. ### References https://github.com/enonic/xp/issues/9253

    References: https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf, https://nvd.nist.gov/vuln/detail/CVE-2024-23679, https://github.com/enonic/xp/issues/9253, https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff, https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4, https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842, https://github.com/enonic/xp, https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf

    Affected packages

    Package

    Name: com.enonic.xp:lib-auth

    Purl: pkg:maven/com.enonic.xp/lib-auth

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -7.7.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-4m5p-5w5w-3jcf | CVE-DB