What is CVE-2024-58317?

CVE-2024-58317 is a medium-severity vulnerability in Kentico Xperience, classified under Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. CVSS score: 5.3/10. Published 2025-12-18.

How severe is CVE-2024-58317?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Kentico Xperience

CVE-2024-58317

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session security and authentication state.

EPSS: 0.002 (6.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Kentico Xperience — versions 0

Weakness classification (CWE)

CWE-614 — Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

References

disclosure@vulncheck.com (Product, vendor-advisory, patch)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2024-58317?: CVE-2024-58317 is a medium-severity vulnerability in Kentico Xperience, classified under Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. CVSS score: 5.3/10. Published 2025-12-18.
How severe is CVE-2024-58317?: Medium severity. CVSS v3 base score is 5.3 out of 10.