{"id":"CVE-2024-25977","aliases":["EUVD-2024-23279"],"status":"published","title":"Session Fixation","description":"The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00569,"percentile":0.47571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-384"],"published":"2024-05-29T12:31:29Z","modified":"2026-10-28T02:30:44Z","products":[{"vendor":"interaction design team at the university of applied sciences and arts in hildesheim/germany","product":"hawki"}],"references":[{"url":"https://r.sec-consult.com/hawki","tags":["third-party-advisory","x_transferred","advisory"]},{"url":"https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1","tags":["patch","x_transferred","fix"]},{"url":"http://seclists.org/fulldisclosure/2024/May/34","tags":["x_transferred","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25977.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25977","tags":["advisory"]},{"url":"https://github.com/HAWK-Digital-Environments/HAWKI","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-25977","title":"Session Fixation","description":"The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.","status":"published","published":"2024-05-29T12:31:29.973Z","modified":"2025-02-13T17:40:58.166Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-23279","description":"The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.","status":"published","published":"2024-05-29T12:31:29Z","modified":"2025-02-13T17:40:58Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:03:46.532099Z"}],"nvd":[{"id":"CVE-2024-25977","description":"The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.","status":"published","published":"2024-05-29T13:15:49.683Z","modified":"2026-06-17T07:16:50.493Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"CVE-2024-25977","title":"Session Fixation","description":"The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.","status":"published","published":"2024-05-29T12:31:29.973Z","modified":"2026-10-28T02:30:44.119493136Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T15:44:39.244433Z"}]}}