CVE-2024-23679

CriticalCVSS 9.8

Published: 19/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.84%

54th percentile - higher than 54% of all known CVEs

Summary

CVE-2024-23679 in Enonic XP versions before 7.7.4 allows a remote unauthenticated attacker to reuse prior sessions due to missing session attribute invalidation.

Risk Assessment

An attacker can hijack a user session, leading to unauthorized system access and potential data theft or privilege escalation.

Recommendation

Immediately upgrade Enonic XP to version 7.7.4 or later, which includes a fix for session attribute invalidation.

Original NVD description (English source)

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.