CVE-2024-35222

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
May 23, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-352235.3Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invokCVE-2024-352245.4OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. ThCVE-2024-352256.1Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access tCVE-2024-352267.3Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions temCVE-2024-352277.5Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352285.5Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.sCVE-2024-352295.3ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern CVE-2024-35238.8A vulnerability classified as critical was found in Campcodes Online Event Management System 1.0. This vulnerability affects unknown code ofCVE-2024-352305.3GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the weCVE-2024-352318.6rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5CVE-2024-352323.7github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accCVE-2024-352346.1Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`