PT-2022-16874 · Geon · Geon

Lobometalurgico + 1 · Published 2022-03-24 · Updated 2022-03-31 · CVE-2022-24781

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Geon versions prior to 1.1.0

Description The issue allows malicious users to obtain the uuid from other users and spoof it through the browser console, becoming co-owners of the target session. This is related to the Geon board game, which focuses on solving questions about the Pythagorean Theorem.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the browser console to minimize the risk of uuid spoofing.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-24781

GHSA-4FV9-G2JH-J5XM

Affected Products

Geon

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24781.json · Exploit
• https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19 · Patch
• https://osv.dev/vulnerability/CVE-2022-24781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24781 · Security Note
• https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm · Note
• https://github.com/math-geon/Geon/releases/tag/v1.1.0 · Note
• https://t.me/cibsecurity/39512 · Telegram Post