PT-2024-19302 · Apache · Apache Helix Front

Jonathan Leitschuh · CVE-2024-22281 · Published 2024-08-20 · Updated 2024-08-21

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Helix Front (UI) versions all

Description The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects products that are no longer supported by the maintainer.

Recommendations As this project is retired and no fix will be released, users are recommended to find an alternative or restrict access to the instance to trusted users.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2024-22281

GHSA-6247-7862-Q2PQ

Affected Products

Apache Helix Front

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-22281 · Security Note
• https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6247-7862-q2pq · Vendor Advisory
• https://github.com/apache/helix · Note
• http://openwall.com/lists/oss-security/2024/08/20/3 · Note
• https://t.me/cvenotify/91435 · Telegram Post
• https://twitter.com/CVEnew/status/1826023968500756986 · Twitter Post
• https://t.me/cvedetector/3694 · Telegram Post
• https://twitter.com/oss_security/status/1825937972925202854 · Twitter Post