CVE-2024-23679 describes a session fixation vulnerability in Enonic XP versions less than 7.7.4. The issue arises because the application fails to invalidate session attributes properly, enabling a remote and unauthenticated attacker to reuse existing session identifiers. This flaw can allow the attacker to hijack user sessions, potentially leading to unauthorized access and full system compromise. The vulnerability is classified under CWE-384 (Session Fixation) and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to fixate a session and hijack it, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access to sensitive data and full control over the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's security advisories for updates. Until a fix is available, consider implementing temporary mitigations such as enforcing session invalidation on login and regenerating session identifiers to reduce risk.