CVE-2024-22281CWE-668

Apache Helix Front (UI): Helix front hard-coded secret in the express-session

High · published August 20, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.

This issue affects Apache Helix Front (UI): all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00726 · 53.6th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2024-08-20T22:11Z
EPSS history
Timeline
  • 20 AUG 22:11Z
    Apache Helix Front (UI): Helix front hard-coded secret in the express-session
    cvelistv5