com.enonic.xp:lib-auth vulnerable to Session Fixation

CRITICO 9.8CVE-2024-23679 · GHSA-4m5p-5w5w-3jcf · Published 19/01/2024 · updated 14/07/2026

In breve

CVE-2024-23679 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda com.enonic.xp:lib-auth, xp (enonic).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.84%, superiore al 58.0% delle vulnerabilità.
Correzione: aggiornare a 7.7.4 o successiva.

Package	Affected versions	Patched versions
com.enonic.xp:lib-auth Maven	`< 7.7.4`	`7.7.4`
xp enonic	`= 7.8.0< 7.7.4`	`7.7.4`

Description

Impact

All id-providers using lib-auth login method.

Patches

https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4

Workarounds

Don't use lib-auth for login. Java API uses low-level structures and allows to invalidate previous session before auth-info is added.

References

https://github.com/enonic/xp/issues/9253

NVD description

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

References

enonic/xp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-23679 · ADVISORY
enonic/xp · WEB
enonic/xp commit 0189975 · WEB
enonic/xp commit 1f44674 · WEB
enonic/xp commit 2abac31 · WEB
enonic/xp · PACKAGE
vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf · WEB
GitHub Advisory GHSA-4m5p-5w5w-3jcf · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free