CVE-2024-58317CWE-614

Kentico Xperience <= 13.0.164 Cookie Security Configuration

Medium · published December 18, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session security and authentication state.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Published
2025-12-18T19:53Z
EPSS history
Timeline
  • 18 DEC 19:53Z
    Kentico Xperience <= 13.0.164 Cookie Security Configuration
    cvelistv5