com.enonic.xp:lib-auth vulnerable to Session Fixation

심각 9.8CVE-2024-23679 · GHSA-4m5p-5w5w-3jcf · Published 19/01/2024 · updated 14/07/2026

요약

CVE-2024-23679은(는) com.enonic.xp:lib-auth, xp (enonic)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.84%, 전체 취약점의 58.0%보다 높음.
조치: 7.7.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.enonic.xp:lib-auth Maven	`< 7.7.4`	`7.7.4`
xp enonic	`= 7.8.0< 7.7.4`	`7.7.4`

Description

Impact

All id-providers using lib-auth login method.

Patches

https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4

Workarounds

Don't use lib-auth for login. Java API uses low-level structures and allows to invalidate previous session before auth-info is added.

References

https://github.com/enonic/xp/issues/9253

NVD description

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

References

enonic/xp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-23679 · ADVISORY
enonic/xp · WEB
enonic/xp commit 0189975 · WEB
enonic/xp commit 1f44674 · WEB
enonic/xp commit 2abac31 · WEB
enonic/xp · PACKAGE
vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf · WEB
GitHub Advisory GHSA-4m5p-5w5w-3jcf · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free