CVE-2024-58317 Kentico Xperience <= 13.0.164 Cookie Security Configuration
Attackers can bypass SSL requirements for administration cookies in Kentico Xperience, potentially compromising session security and authentication state.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58317?
CVE-2024-58317 is a medium-severity vulnerability in Kentico Xperience, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session security and authentication state.
Weakness: CWE-614
Which versions are affected by CVE-2024-58317?
It affects 1 product.
Products include Kentico Xperience.
How do I fix CVE-2024-58317?
No fix has been published for CVE-2024-58317 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-58317 being exploited?
There is no known exploitation of CVE-2024-58317 in the wild and no public exploit code.
Other vulnerabilities in Kentico Xperience
- CVE-2025-2746 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel
- CVE-2025-2747 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel
- CVE-2019-10068 Kentico Xperience Deserialization of Untrusted Data
- CVE-2025-2749 Kentico Xperience Path Traversal
- CVE-2017-17736 Missing authorization in n/a
Sources
Also known as GHSA-q48x-g537-f47g.