[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCV8Ufb9IkhNbsBkjdgaFGYbJPsdHILw2M2Q71t9FDC4":3,"g5a-risk:CVE-2022-24740":244},{"success":4,"data":5,"meta":242},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":48,"epssPercentile":26,"epssTimeSeries":49,"severity":50,"affectedProducts":51,"affectedProductsCount":63,"references":64,"referencesCount":74,"weaknesses":75,"weaknessesCount":84,"isActivelyExploited":85,"cisaInfo":26,"otxData":26,"relatedBlogPosts":86,"seoMetadata":87,"configurations":112,"relatedVendorCves":240,"notableEvents":241},"CVE-2022-24740","What is CVE-2022-24740?","Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library.","Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authen...","2022-03-14T23:15:08.303","2022-03-22T15:10:47.207",7.5,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":38,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":22,"BaseScore":12,"BaseSeverity":22,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":22,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","HIGH","LOW","NONE","UNCHANGED",null,1.6,5.9,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":37},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":33,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":24,"UserInteraction":34,"Scope":25,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":35,"BaseSeverity":36,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L","REQUIRED",5,"MEDIUM",3.4,[39],{"Source":17,"Type":18,"CVSSData":40,"BaseSeverity":36,"ExploitabilityScore":46,"ImpactScore":47,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":41,"VectorString":42,"AccessVector":21,"AccessComplexity":36,"Authentication":43,"ConfidentialityImpact":44,"IntegrityImpact":44,"AvailabilityImpact":44,"BaseScore":45,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:M\u002FAu:S\u002FC:P\u002FI:P\u002FA:P","SINGLE","PARTIAL",6,6.8,6.4,0.00589,[48,48,48,48,48,48,48],"High",[52,57,60],{"vendor":53,"product":54,"version":55,"criteria":56,"vulnerable":4},"plone","volto","*","cpe:2.3:a:plone:volto:*:*:*:*:*:node.js:*:*",{"vendor":53,"product":54,"version":58,"criteria":59,"vulnerable":4},"14.0.0","cpe:2.3:a:plone:volto:14.0.0:-:*:*:*:node.js:*:*",{"vendor":53,"product":54,"version":61,"criteria":62,"vulnerable":4},"15.0.0","cpe:2.3:a:plone:volto:15.0.0:alpha0:*:*:*:node.js:*:*",3,[65,71],{"url":66,"source":67,"tags":68},"https:\u002F\u002Fgithub.com\u002Fplone\u002Fvolto\u002Fpull\u002F3051","GitHub",[69,70],"Patch","Third Party Advisory",{"url":72,"source":67,"tags":73},"https:\u002F\u002Fgithub.com\u002Fplone\u002Fvolto\u002Fsecurity\u002Fadvisories\u002FGHSA-cfhh-xgwq-5r67",[69,70],2,[76],{"id":77,"name":78,"description":79,"extendedDescription":80,"status":81,"abstraction":82,"structure":83},"CWE-287","Improper Authentication","When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","","Draft","Class","Simple",1,false,[],{"title":88,"metaDescription":89,"keywords":90,"canonicalUrl":91,"structuredData":92},"What is CVE-2022-24740? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-24740, a high severity cyber security vulnerability from 2022. Volto is a ReactJS-based frontend for the Plone Content Man...","CVE-2022-24740, CVE-2022-24740 vulnerability, CVE-2022-24740 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, plone security, volto vulnerability","\u002Fwhat-is\u002Fcve-2022-24740",{"@context":93,"@type":94,"headline":88,"description":89,"datePublished":10,"dateModified":11,"author":95,"publisher":99,"about":103,"mainEntityOfPage":107,"articleSection":110,"keywords":111},"https:\u002F\u002Fschema.org","TechArticle",{"@type":96,"name":97,"url":98},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":96,"name":97,"url":98,"logo":100},{"@type":101,"url":102},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":104,"name":6,"description":105,"additionalType":106},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":108,"@id":109},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-24740","Cybersecurity","CVE-2022-24740, CVE-2022-24740 vulnerability, CVE-2022-24740 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[113],{"Operator":26,"Negate":26,"Nodes":114},[115],{"Operator":116,"Negate":26,"CPEMatch":117},"OR",[118,122,124,127,130,133,136,139,142,145,148,151,154,157,160,163,166,169,172,175,178,181,184,187,190,193,196,199,202,205,208,211,214,217,220,223,226,229,232,235,238],{"Vulnerable":4,"Criteria":56,"MatchCriteriaID":119,"VersionStartExcluding":26,"VersionStartIncluding":120,"VersionEndExcluding":26,"VersionEndIncluding":121},"2E7BD0E0-F1F4-4BF8-8F28-A854D2913697","14.1.0","14.10.0",{"Vulnerable":4,"Criteria":59,"MatchCriteriaID":123,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"60B6B474-333B-4990-A3C6-2AE21C35E4FB",{"Vulnerable":4,"Criteria":125,"MatchCriteriaID":126,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha10:*:*:*:node.js:*:*","E2A552C6-510A-4402-8D36-D7A135387BA1",{"Vulnerable":4,"Criteria":128,"MatchCriteriaID":129,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha11:*:*:*:node.js:*:*","1616F781-5110-4CC2-AADD-72F8CE3A9CFF",{"Vulnerable":4,"Criteria":131,"MatchCriteriaID":132,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha12:*:*:*:node.js:*:*","531D33BA-E569-4465-93D9-7C4E09CE68E8",{"Vulnerable":4,"Criteria":134,"MatchCriteriaID":135,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha13:*:*:*:node.js:*:*","BF717E0B-196F-4132-8AFD-7A734D39FB34",{"Vulnerable":4,"Criteria":137,"MatchCriteriaID":138,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha14:*:*:*:node.js:*:*","64AB5576-987F-4762-9C50-E2C5D5E3FDFA",{"Vulnerable":4,"Criteria":140,"MatchCriteriaID":141,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha15:*:*:*:node.js:*:*","133BF4F5-2288-4B40-B54B-1009DD01D895",{"Vulnerable":4,"Criteria":143,"MatchCriteriaID":144,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha16:*:*:*:node.js:*:*","A4BEF957-A8DE-421B-B720-935E6E6BB9EF",{"Vulnerable":4,"Criteria":146,"MatchCriteriaID":147,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha17:*:*:*:node.js:*:*","F0971799-2693-4030-BD1D-51E40A61199F",{"Vulnerable":4,"Criteria":149,"MatchCriteriaID":150,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha18:*:*:*:node.js:*:*","CD8E68A2-E8E4-40BF-8D49-C07453A0FEDB",{"Vulnerable":4,"Criteria":152,"MatchCriteriaID":153,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha19:*:*:*:node.js:*:*","59CB7B21-5889-46FD-970F-B09FF8D60B13",{"Vulnerable":4,"Criteria":155,"MatchCriteriaID":156,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha20:*:*:*:node.js:*:*","ACE67F50-325E-4462-997E-C0F297CF920D",{"Vulnerable":4,"Criteria":158,"MatchCriteriaID":159,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha21:*:*:*:node.js:*:*","2AA47A36-244F-4654-91AF-98A05D620169",{"Vulnerable":4,"Criteria":161,"MatchCriteriaID":162,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha22:*:*:*:node.js:*:*","EA571792-AB7B-4A94-96CB-86A829902DC2",{"Vulnerable":4,"Criteria":164,"MatchCriteriaID":165,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha23:*:*:*:node.js:*:*","B6A677A4-1C58-4FF9-A931-76DF96B2784A",{"Vulnerable":4,"Criteria":167,"MatchCriteriaID":168,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha24:*:*:*:node.js:*:*","3CBF93E1-41B3-4CB9-AE37-A714BDEC6B1C",{"Vulnerable":4,"Criteria":170,"MatchCriteriaID":171,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha25:*:*:*:node.js:*:*","EF197A8E-AFA1-4359-BB6E-E0E59786B6D0",{"Vulnerable":4,"Criteria":173,"MatchCriteriaID":174,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha26:*:*:*:node.js:*:*","A9CEACFB-27A7-47D7-BB9F-1BEEF4048693",{"Vulnerable":4,"Criteria":176,"MatchCriteriaID":177,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha27:*:*:*:node.js:*:*","E20A0DBE-42D8-4B66-B1D2-205FD7704796",{"Vulnerable":4,"Criteria":179,"MatchCriteriaID":180,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha28:*:*:*:node.js:*:*","0B9F8356-065A-417D-BD35-981619FAEFC6",{"Vulnerable":4,"Criteria":182,"MatchCriteriaID":183,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha29:*:*:*:node.js:*:*","1ABC60C5-DCEA-434F-82DB-3924D9F6F450",{"Vulnerable":4,"Criteria":185,"MatchCriteriaID":186,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha30:*:*:*:node.js:*:*","C404E110-20A8-4149-A8DA-135E1785E2DD",{"Vulnerable":4,"Criteria":188,"MatchCriteriaID":189,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha31:*:*:*:node.js:*:*","475A2C57-6A5B-4787-92FE-F6D4552744FD",{"Vulnerable":4,"Criteria":191,"MatchCriteriaID":192,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha32:*:*:*:node.js:*:*","171719F9-918D-413F-AB60-5261A4205CEF",{"Vulnerable":4,"Criteria":194,"MatchCriteriaID":195,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha33:*:*:*:node.js:*:*","7241B9C4-277C-43A6-8C32-79677B334EA4",{"Vulnerable":4,"Criteria":197,"MatchCriteriaID":198,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha34:*:*:*:node.js:*:*","5449FA9F-0C01-4259-8B6E-6DAA9F9C5F54",{"Vulnerable":4,"Criteria":200,"MatchCriteriaID":201,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha35:*:*:*:node.js:*:*","8A76D371-4BDA-4751-B511-FCF99FAEC3E0",{"Vulnerable":4,"Criteria":203,"MatchCriteriaID":204,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha36:*:*:*:node.js:*:*","5DCCE12A-131B-4A2A-9DB3-3DCB252E2FB5",{"Vulnerable":4,"Criteria":206,"MatchCriteriaID":207,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha37:*:*:*:node.js:*:*","E4719B30-4F29-4CD9-9B71-6F4FF000BC17",{"Vulnerable":4,"Criteria":209,"MatchCriteriaID":210,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha38:*:*:*:node.js:*:*","71EFFE80-FEAA-4F6F-AF5C-2CC1F8B1A5D3",{"Vulnerable":4,"Criteria":212,"MatchCriteriaID":213,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha39:*:*:*:node.js:*:*","1F7327CD-E127-44C5-A458-5EF227D154D6",{"Vulnerable":4,"Criteria":215,"MatchCriteriaID":216,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha40:*:*:*:node.js:*:*","4CB1DCB6-45C1-40FD-92A0-E14E75D28C05",{"Vulnerable":4,"Criteria":218,"MatchCriteriaID":219,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha41:*:*:*:node.js:*:*","E30BAF62-8A05-4CEA-95D6-C97E20016019",{"Vulnerable":4,"Criteria":221,"MatchCriteriaID":222,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha42:*:*:*:node.js:*:*","7F193851-4373-4B00-A12B-9D8C4D9F1475",{"Vulnerable":4,"Criteria":224,"MatchCriteriaID":225,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha43:*:*:*:node.js:*:*","4D5542A2-3C0B-4B11-B454-4196FD2A6714",{"Vulnerable":4,"Criteria":227,"MatchCriteriaID":228,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha6:*:*:*:node.js:*:*","2F8AECF3-3092-4C3A-AF90-571C4950F3F2",{"Vulnerable":4,"Criteria":230,"MatchCriteriaID":231,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha7:*:*:*:node.js:*:*","9C3EA246-64F5-4AE9-9C2C-72E1AD329A6E",{"Vulnerable":4,"Criteria":233,"MatchCriteriaID":234,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha8:*:*:*:node.js:*:*","A22D0AAD-C038-42C2-A740-A8B0470E279B",{"Vulnerable":4,"Criteria":236,"MatchCriteriaID":237,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:plone:volto:14.0.0:alpha9:*:*:*:node.js:*:*","6F4F65D0-263E-4DC4-B33A-832A35ADD086",{"Vulnerable":4,"Criteria":62,"MatchCriteriaID":239,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"468217AF-833A-4A73-87C5-4BABFB3CE67A",[],[],{"lastModified":11,"cacheTime":243,"version":41},1792266317705,{"score":245,"band":246,"action":247,"scoredAt":248},46,"Medium","Plan remediation","2026-10-16T06:53:48.917797+00:00"]