PT-2022-16843 · Volto+1 · Volto+1

Sneridagh · Published 2022-03-14 · Updated 2022-03-22 · CVE-2022-24740

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Volto versions 14.0.0-alpha.5 through 15.0.0-alpha.0

Description The issue occurs when using an outdated version of the react-cookie library and a server is under high load, allowing a user's authentication cookie to be replaced with another user's, effectively giving them control of the other user's account and privileges. Although a proof of concept does not currently exist, it is possible for this issue to occur in the wild.

Recommendations For Volto versions 14.0.0-alpha.5 through 15.0.0-alpha.0, upgrade to Volto 15.0.0-alpha.0 or later to resolve the issue. As a temporary workaround, manually upgrade the react-cookie package to 4.1.1 and override all Volto components that use this library.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-24740

GHSA-CFHH-XGWQ-5R67

Affected Products

Volto

React-Cookie

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24740.json · Exploit
• https://github.com/plone/volto/security/advisories/GHSA-cfhh-xgwq-5r67 · Patch
• https://github.com/plone/volto/pull/3051 · Patch
• https://osv.dev/vulnerability/CVE-2022-24740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24740 · Security Note
• https://osv.dev/vulnerability/GHSA-cfhh-xgwq-5r67 · Vendor Advisory
• https://github.com/plone/volto · Note