GHSA-4m5p-5w5w-3jcf

com.enonic.xp:lib-auth vulnerable to Session Fixation

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-23679

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.enonic.xp:lib-auth	< 7.7.4	7.7.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact All id-providers using lib-auth `login` method. ### Patches https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4 ### Workarounds Don't use lib-auth for `login`. Java API uses low-level structures and allows to invalidate previous session before auth-info is added. ### References https://github.com/enonic/xp/issues/9253

References

External links from the advisory. They lead to third-party sites.

https://github.com/enonic/xp/security/advisories/GHSA-4m5p-5w5w-3jcf web
https://nvd.nist.gov/vuln/detail/CVE-2024-23679 advisory
https://github.com/enonic/xp/issues/9253 web
https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff web
https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4 web
https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 web
https://github.com/enonic/xp package
https://vulncheck.com/advisories/vc-advisory-GHSA-4m5p-5w5w-3jcf web