CVE-2024-58317

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session security and authentication state.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-614

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-583186.1A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor compoCVE-2024-583196.1A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widCVE-2024-58328.8Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafteCVE-2024-583205.3An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname detaiCVE-2024-583215.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule confiCVE-2024-583225.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuratiCVE-2024-583235.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form componenCVE-2024-58338.8Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viCVE-2024-583307.5A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analyticCVE-2024-583355.0OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualizCVE-2024-583365.3Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requestingCVE-2024-583374.3Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access s