CVE-2024-23590

criticalpriority · track · 0EPSS 0.007 · 52 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.67% (52nd) EPSS

CVSS 9.1 · critical

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 3.9 · impact 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-384USCWE-384US

affected products (3)

Products and version ranges known to be affected.

Apache Software Foundation Apache Kylin2.0.0 → 5.0.0enisa_euvdEU
apache kylin2.0.0 → 5.0.0nvdUScpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*
Maven org.apache.kylin:kylin2.0.0 → 5.0.0osvUSpkg:maven/org.apache.kylin/kylin

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-752q-72qc-rc66Apache Kylin Session Fixation vulnerability2024-11-04ghsa · osvUS
Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2024-11-04modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

https://lists.apache.org/thread/7161154h0k6zygr9917qq0g95p39szml cnnvd
https://lists.apache.org/thread/7161154h0k6zygr9917qq0g95p39szml enisa_euvd
http://www.openwall.com/lists/oss-security/2024/11/03/1Mailing ListThird Party Advisorynvd
https://lists.apache.org/thread/7161154h0k6zygr9917qq0g95p39szmlMailing ListVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan