Is CVE-2022-24740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-24740 being exploited in the wild.

How severe is CVE-2022-24740?

Low severity, with a CVSS score of 3.1, published 14 March 2022.

Which products and versions are affected?

@plone/volto (npm) SEMVER:introduced=14.0.0-alpha.6,fixed=15.0.0-alpha.0; Plone Volto 14.0.0-alpha.6 through 14.10.0.

Is there a fix for CVE-2022-24740?

Yes. @plone/volto (npm): upgrade to 15.0.0-alpha.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-24740 attacked?

It is attacked over the network.

Am I affected by CVE-2022-24740?

Check whether you run @plone/volto (npm) or Plone Volto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-24740: Plone Volto auth token swap due to outdated react-cookie

CVE-2022-24740 · Severity: low · CVSS 3.1 · Published 2022-03-14

Volto is a React frontend for the Plone content management system. Due to an outdated react-cookie library dependency, users under high server load conditions can have their authentication tokens replaced with another user's token, granting complete unauthorized access to that user's account and permissions.

Technologies: Plone Volto. Vendors: npm, Plone.

Quick answers

Is CVE-2022-24740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-24740 being exploited in the wild.
How severe is CVE-2022-24740?: Low severity, with a CVSS score of 3.1, published 14 March 2022.
Which products and versions are affected?: @plone/volto (npm) SEMVER:introduced=14.0.0-alpha.6,fixed=15.0.0-alpha.0; Plone Volto 14.0.0-alpha.6 through 14.10.0.
Is there a fix for CVE-2022-24740?: Yes. @plone/volto (npm): upgrade to 15.0.0-alpha.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-24740 attacked?: It is attacked over the network.
Am I affected by CVE-2022-24740?: Check whether you run @plone/volto (npm) or Plone Volto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@plone/volto (npm): upgrade to 15.0.0-alpha.0 or later
```
npm install @plone/volto@15.0.0-alpha.0
```

Technical details

The vulnerability stems from the use of an outdated version of the react-cookie library in Volto versions 14.0.0-alpha.6 through 14.10.0. Under conditions of high server load, a race condition or token handling bug in the react-cookie library can cause one user's authentication cookie to be replaced with another user's cookie. Attack vector is network-based and requires user interaction (browsing the application); no special privileges are required. While no proven public exploit exists and reproduction has been difficult, the vulnerability can occur randomly in production environments. The fix is available in Volto 15.0.0-alpha.0 and later, which upgrades react-cookie to version 4.1.1 and includes related component changes.

Affected products

Plone Volto 14.0.0-alpha.6 through 14.10.0

Identifiers

CVE-2022-24740
GHSA-cfhh-xgwq-5r67

Timeline

2022-03-14: disclosed
2022-03-14: patched: Fix available in Volto 15.0.0-alpha.0 and later

References

https://github.com/plone/volto/security/advisories/GHSA-cfhh-xgwq-5r67

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.