CVE-2024-23679: enonic xp

csirt@kutim:~/threat-intel/cve/CVE-2024-23679

CVSS 9.8 · Critical EPSS 0,84%

Kerentanan Session Fixation pada enonic xp. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.

Rincian

Terbit di NVD: 19 Januari 2024
Terakhir diubah: 14 Juli 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-384: Session Fixation
EPSS (30 hari): 0,84% peluang dieksploitasi; lebih tinggi dari 56,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
enonic	xp	Semua versi sebelum 7.7.4
enonic	xp	Versi 7.8.0 beta1
enonic	xp	Versi 7.8.0 beta2
enonic	xp	Versi 7.8.0 beta3
enonic	xp	Versi 7.8.0 rc1
enonic	xp	Versi 7.8.0 rc2
enonic	xp	Versi 7.8.0 rc3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf patch · advisory vendor
https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff patch
https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4 patch
https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 patch
https://github.com/advisories/GHSA-4m5p-5w5w-3jcf advisory pihak ketiga
https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf advisory pihak ketiga
https://github.com/enonic/xp/issues/9253 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.