CVE-2022-24781

Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists.

CVSS v3 7.1 HIGH
CVSS v2.0 5.5 MEDIUM

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19	Patch Third Party Advisory
https://github.com/math-geon/Geon/releases/tag/v1.1.0	Release Notes Third Party Advisory
https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:geon_project:geon:1.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-24 21:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-24781

Mitre link : CVE-2022-24781

CVE.ORG link : CVE-2022-24781

JSON object : View

Products Affected

geon_project

geon

CWE

CWE-384

Session Fixation

{"id": "CVE-2022-24781", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2022-03-24T21:15:13.850", "references": [{"url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists."}, {"lang": "es", "value": "Geon es un juego de mesa basado en la resoluci\u00f3n de preguntas sobre el Teorema de Pit\u00e1goras. Unos usuarios maliciosos pueden obtener el uuid de otros usuarios, falsificar ese uuid mediante la consola del navegador y convertirse en copropietarios de la sesi\u00f3n de destino. Este problema est\u00e1 parcheado en la versi\u00f3n 1.1.0. No se presenta ninguna medida de mitigaci\u00f3n conocida"}], "lastModified": "2022-03-31T19:49:32.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geon_project:geon:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B63C197-3AA7-4D4F-88AE-F1A60B718CAE"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}