7.5

CVE-2022-24740

Improper Authentication in Volto

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Plone ≫ Volto SwPlatform node.js Version >= 14.1.0 <= 14.10.0
Plone ≫ Volto Version 14.0.0 Update - SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha10 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha11 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha12 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha13 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha14 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha15 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha16 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha17 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha18 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha19 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha20 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha21 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha22 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha23 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha24 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha25 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha26 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha27 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha28 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha29 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha30 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha31 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha32 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha33 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha34 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha35 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha36 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha37 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha38 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha39 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha40 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha41 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha42 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha43 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha6 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha7 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha8 SwPlatform node.js
Plone ≫ Volto Version 14.0.0 Update alpha9 SwPlatform node.js
Plone ≫ Volto Version 15.0.0 Update alpha0 SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.448
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
security-advisories@github.com 5 1.6 3.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://github.com/plone/volto/pull/3051
Patch
Third Party Advisory
https://github.com/plone/volto/security/advisories/GHSA-cfhh-xgwq-5r67
Patch
Third Party Advisory