CVE-2024-38368 (GCVE-0-2024-38368)
Vulnerability from cvelistv5
Published
2024-07-01 21:05
Modified
2024-08-02 04:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Summary
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.
References
| ► | URL | Tags |
|---|---|---|
|
|
||
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cocoapods:cocoapods:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cocoapods",
"vendor": "cocoapods",
"versions": [
{
"lessThan": "71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-30T03:55:41.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:04:25.189Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx"
},
{
"name": "https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4"
},
{
"name": "https://blog.cocoapods.org/Claim-Your-Pods",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blog.cocoapods.org/Claim-Your-Pods"
},
{
"name": "https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023"
},
{
"name": "https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CocoaPods",
"vendor": "CocoaPods",
"versions": [
{
"status": "affected",
"version": "\u003c 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-02T17:00:15.687Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx"
},
{
"name": "https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4"
},
{
"name": "https://blog.cocoapods.org/Claim-Your-Pods",
"tags": [
"x_refsource_MISC"
],
"url": "https://blog.cocoapods.org/Claim-Your-Pods"
},
{
"name": "https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023",
"tags": [
"x_refsource_MISC"
],
"url": "https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023"
},
{
"name": "https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods",
"tags": [
"x_refsource_MISC"
],
"url": "https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods"
}
],
"source": {
"advisory": "GHSA-j483-qm5c-7hqx",
"discovery": "UNKNOWN"
},
"title": "Trunk\u0027s \u0027Claim your pod\u0027 could be used to obtain un-used pods"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-38368",
"datePublished": "2024-07-01T21:05:48.031Z",
"dateReserved": "2024-06-14T14:16:16.466Z",
"dateUpdated": "2024-08-02T04:04:25.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38368\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-03T14:22:01.465503Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:cocoapods:cocoapods:*:*:*:*:*:*:*:*\"], \"vendor\": \"cocoapods\", \"product\": \"cocoapods\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-03T14:22:28.090Z\"}}], \"cna\": {\"title\": \"Trunk\u0027s \u0027Claim your pod\u0027 could be used to obtain un-used pods\", \"source\": {\"advisory\": \"GHSA-j483-qm5c-7hqx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"CocoaPods\", \"product\": \"CocoaPods\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4\"}]}], \"references\": [{\"url\": \"https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx\", \"name\": \"https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4\", \"name\": \"https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://blog.cocoapods.org/Claim-Your-Pods\", \"name\": \"https://blog.cocoapods.org/Claim-Your-Pods\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023\", \"name\": \"https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods\", \"name\": \"https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-over-orphaned-pods\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-668\", \"description\": \"CWE-668: Exposure of Resource to Wrong Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-02T17:00:15.687Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-38368\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-30T03:55:41.062Z\", \"dateReserved\": \"2024-06-14T14:16:16.466Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-01T21:05:48.031Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…