CVE-2024-58317: Kentico Xperience <= 13.0.164 Cookie Security Configuration
A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session security and authentication state.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58317?
CVE-2024-58317 is considered a high severity vulnerability due to its potential to allow attackers to bypass SSL security measures.
How do I fix CVE-2024-58317?
To fix CVE-2024-58317, ensure that the 'requireSSL' attribute is correctly configured in the web.config file of your Kentico Xperience application.
Which versions of Kentico Xperience are affected by CVE-2024-58317?
CVE-2024-58317 affects Kentico Xperience versions up to and including 13.0.164.
What type of vulnerability is CVE-2024-58317?
CVE-2024-58317 is a cookie security configuration vulnerability affecting how SSL requirements are enforced.
What could an attacker achieve by exploiting CVE-2024-58317?
An attacker exploiting CVE-2024-58317 could potentially compromise the security of administration cookies by bypassing SSL, leading to unauthorized access.