CVE-2022-24740

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Mar 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-247416.5Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of servicCVE-2022-247425.5Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab CVE-2022-247438.2Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the paCVE-2022-247443.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessionCVE-2022-247456.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessioCVE-2022-247466.1Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possibCVE-2022-247475.3Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do CVE-2022-247487.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it iCVE-2022-247496.1Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containiCVE-2022-24758.8Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any useCVE-2022-247507.8UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM pCVE-2022-247517.4Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition
CVE-2022-24740: High severity, CVSS 7.5 | Vulnix