CVE-2024-22281

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22281
** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front (UI): all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/08/20/3 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:helix:*:*:*:*:*:*:*:*
History

10 Jul 2025, 21:14

Type Values Removed Values Added
First Time Apache
Apache helix
References () https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny - () https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/08/20/3 - () http://www.openwall.com/lists/oss-security/2024/08/20/3 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:helix:*:*:*:*:*:*:*:*

21 Nov 2024, 08:55

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/08/20/3 -

21 Aug 2024, 14:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
Summary
  • (es) ** NO COMPATIBLE CUANDO SE ASIGNÓ ** El componente Apache Helix Front (UI) contenía un secreto codificado que permitía a un atacante falsificar sesiones generando sus propias cookies falsas. Este problema afecta a Apache Helix Front (UI): todas las versiones. Como este proyecto está retirado, no planeamos lanzar una versión que solucione este problema. Se recomienda a los usuarios que busquen una alternativa o restrinjan el acceso a la instancia a usuarios confiables. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante.

20 Aug 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-20 23:15

Updated : 2025-07-10 21:14

NVD link : CVE-2024-22281

Mitre link : CVE-2024-22281

CVE.ORG link : CVE-2024-22281

JSON object : View

Products Affected

apache

  • helix
CWE
CWE-668

Exposure of Resource to Wrong Sphere