CVE-2024-58317 MEDIUM

CVE-2024-58317: Kentico Xperience <= 13.0.164 Cookie Security Configuration

Vendor Kentico
Product Xperience
Weakness CWE-614 · Cookie without Secure flag
Published December 18, 2025
Last update December 18, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session security and authentication state.

Key dates

02Disclosure timeline

December 18, 2025 CVE published
December 18, 2025 Record updated