CVE-2024-23679

CVE-2024-23679: Enonic XP Session Fixation Vulnerability

Weakness CWE-384 · Session fixation

Published January 19, 2024

Last update November 29, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

Key dates

02Disclosure timeline

January 19, 2024 CVE published

November 29, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-23679 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/384.html

Related vulnerabilities

04Related CVE

CVE-2024-10158 PHPGurukul Boat Booking System session_start session fixiation CVE-2025-29928 authentik's deletion of sessions did not revoke sessions when using database session storage CVE-2025-55668 Apache Tomcat: session fixation via rewrite valve CVE-2020-36913 All-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass CVE-2022-43398