Versio.io

CVE-2022-24740

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 15-03-2022 12:15
Last modified: - 22-03-2022 04:10
Total changes: - 3

Description

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
High
Attack complexity
Network
Attack vector
High
Availability
High
Confidentiality
High
Integrity
Low
Privileges required
Unchanged
Scope
None
User interaction
7.5
Base score
1.6
5.9
Exploitability score
Impact score
 

Verification logic

OR
vendor=plone AND product=volto AND version=14.0.0 AND update=- AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha10 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha11 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha12 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha13 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha14 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha15 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha16 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha17 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha18 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha19 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha20 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha21 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha22 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha23 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha24 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha25 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha26 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha27 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha28 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha29 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha30 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha31 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha32 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha33 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha34 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha35 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha36 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha37 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha38 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha39 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha40 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha41 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha42 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha43 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha6 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha7 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha8 AND target_software=node.js
vendor=plone AND product=volto AND version=14.0.0 AND update=alpha9 AND target_software=node.js
vendor=plone AND product=volto AND target_software=node.js AND versionEndIncluding=14.10.0 AND versionStartIncluding=14.1.0
vendor=plone AND product=volto AND version=15.0.0 AND update=alpha0 AND target_software=node.js
 

Reference

 


Keywords

NVD

 

CVE-2022-24740

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.