Read the docs
TI-2022-08554 Aliases CVE-2022-24740GHSA-cfhh-xgwq-5r67

Improper Authentication in Volto

Priority LOW 34CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00589 48th percentileScored 2026-11-07
Fix Fixed volto (plone): 15.0.0-alpha.0@plone/volto (npm): 15.0.0-alpha.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
plonevolto14.0.0-alpha.5 to before 15.0.0-alpha.015.0.0-alpha.0Patch availableCNA
—@plone/volto (npm)14.0.0-alpha.6 to before 15.0.0-alpha.015.0.0-alpha.0Patch availableGHSA-cfhh-xgwq-5r67
  • volto Vendorplone Affected 14.0.0-alpha.5 to before 15.0.0-alpha.0 Fixed in 15.0.0-alpha.0 Patch available CNA
  • @plone/volto (npm) Vendor— Affected 14.0.0-alpha.6 to before 15.0.0-alpha.0 Fixed in 15.0.0-alpha.0 Patch available GHSA-cfhh-xgwq-5r67

CPE configurations NVD · 41

CPEVersionsRoleVendor
cpe:2.3:a:plone:volto:*:*:*:*:*:node.js:*:*14.1.0 – 14.10.0Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:-:*:*:*:node.js:*:*14.0.0Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha10:*:*:*:node.js:*:*14.0.0 alpha10Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha11:*:*:*:node.js:*:*14.0.0 alpha11Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha12:*:*:*:node.js:*:*14.0.0 alpha12Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha13:*:*:*:node.js:*:*14.0.0 alpha13Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha14:*:*:*:node.js:*:*14.0.0 alpha14Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha15:*:*:*:node.js:*:*14.0.0 alpha15Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha16:*:*:*:node.js:*:*14.0.0 alpha16Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha17:*:*:*:node.js:*:*14.0.0 alpha17Vulnerableplone
  • cpe:2.3:a:plone:volto:*:*:*:*:*:node.js:*:* Versions 14.1.0 – 14.10.0 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:-:*:*:*:node.js:*:* Versions 14.0.0 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha10:*:*:*:node.js:*:* Versions 14.0.0 alpha10 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha11:*:*:*:node.js:*:* Versions 14.0.0 alpha11 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha12:*:*:*:node.js:*:* Versions 14.0.0 alpha12 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha13:*:*:*:node.js:*:* Versions 14.0.0 alpha13 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha14:*:*:*:node.js:*:* Versions 14.0.0 alpha14 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha15:*:*:*:node.js:*:* Versions 14.0.0 alpha15 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha16:*:*:*:node.js:*:* Versions 14.0.0 alpha16 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha17:*:*:*:node.js:*:* Versions 14.0.0 alpha17 Vulnerable ·plone
Show 31 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:plone:volto:14.0.0:alpha18:*:*:*:node.js:*:*14.0.0 alpha18Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha19:*:*:*:node.js:*:*14.0.0 alpha19Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha20:*:*:*:node.js:*:*14.0.0 alpha20Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha21:*:*:*:node.js:*:*14.0.0 alpha21Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha22:*:*:*:node.js:*:*14.0.0 alpha22Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha23:*:*:*:node.js:*:*14.0.0 alpha23Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha24:*:*:*:node.js:*:*14.0.0 alpha24Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha25:*:*:*:node.js:*:*14.0.0 alpha25Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha26:*:*:*:node.js:*:*14.0.0 alpha26Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha27:*:*:*:node.js:*:*14.0.0 alpha27Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha28:*:*:*:node.js:*:*14.0.0 alpha28Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha29:*:*:*:node.js:*:*14.0.0 alpha29Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha30:*:*:*:node.js:*:*14.0.0 alpha30Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha31:*:*:*:node.js:*:*14.0.0 alpha31Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha32:*:*:*:node.js:*:*14.0.0 alpha32Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha33:*:*:*:node.js:*:*14.0.0 alpha33Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha34:*:*:*:node.js:*:*14.0.0 alpha34Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha35:*:*:*:node.js:*:*14.0.0 alpha35Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha36:*:*:*:node.js:*:*14.0.0 alpha36Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha37:*:*:*:node.js:*:*14.0.0 alpha37Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha38:*:*:*:node.js:*:*14.0.0 alpha38Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha39:*:*:*:node.js:*:*14.0.0 alpha39Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha40:*:*:*:node.js:*:*14.0.0 alpha40Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha41:*:*:*:node.js:*:*14.0.0 alpha41Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha42:*:*:*:node.js:*:*14.0.0 alpha42Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha43:*:*:*:node.js:*:*14.0.0 alpha43Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha6:*:*:*:node.js:*:*14.0.0 alpha6Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha7:*:*:*:node.js:*:*14.0.0 alpha7Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha8:*:*:*:node.js:*:*14.0.0 alpha8Vulnerableplone
cpe:2.3:a:plone:volto:14.0.0:alpha9:*:*:*:node.js:*:*14.0.0 alpha9Vulnerableplone
cpe:2.3:a:plone:volto:15.0.0:alpha0:*:*:*:node.js:*:*15.0.0 alpha0Vulnerableplone
  • cpe:2.3:a:plone:volto:14.0.0:alpha18:*:*:*:node.js:*:* Versions 14.0.0 alpha18 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha19:*:*:*:node.js:*:* Versions 14.0.0 alpha19 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha20:*:*:*:node.js:*:* Versions 14.0.0 alpha20 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha21:*:*:*:node.js:*:* Versions 14.0.0 alpha21 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha22:*:*:*:node.js:*:* Versions 14.0.0 alpha22 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha23:*:*:*:node.js:*:* Versions 14.0.0 alpha23 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha24:*:*:*:node.js:*:* Versions 14.0.0 alpha24 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha25:*:*:*:node.js:*:* Versions 14.0.0 alpha25 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha26:*:*:*:node.js:*:* Versions 14.0.0 alpha26 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha27:*:*:*:node.js:*:* Versions 14.0.0 alpha27 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha28:*:*:*:node.js:*:* Versions 14.0.0 alpha28 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha29:*:*:*:node.js:*:* Versions 14.0.0 alpha29 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha30:*:*:*:node.js:*:* Versions 14.0.0 alpha30 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha31:*:*:*:node.js:*:* Versions 14.0.0 alpha31 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha32:*:*:*:node.js:*:* Versions 14.0.0 alpha32 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha33:*:*:*:node.js:*:* Versions 14.0.0 alpha33 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha34:*:*:*:node.js:*:* Versions 14.0.0 alpha34 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha35:*:*:*:node.js:*:* Versions 14.0.0 alpha35 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha36:*:*:*:node.js:*:* Versions 14.0.0 alpha36 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha37:*:*:*:node.js:*:* Versions 14.0.0 alpha37 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha38:*:*:*:node.js:*:* Versions 14.0.0 alpha38 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha39:*:*:*:node.js:*:* Versions 14.0.0 alpha39 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha40:*:*:*:node.js:*:* Versions 14.0.0 alpha40 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha41:*:*:*:node.js:*:* Versions 14.0.0 alpha41 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha42:*:*:*:node.js:*:* Versions 14.0.0 alpha42 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha43:*:*:*:node.js:*:* Versions 14.0.0 alpha43 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha6:*:*:*:node.js:*:* Versions 14.0.0 alpha6 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha7:*:*:*:node.js:*:* Versions 14.0.0 alpha7 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha8:*:*:*:node.js:*:* Versions 14.0.0 alpha8 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:14.0.0:alpha9:*:*:*:node.js:*:* Versions 14.0.0 alpha9 Vulnerable ·plone
  • cpe:2.3:a:plone:volto:15.0.0:alpha0:*:*:*:node.js:*:* Versions 15.0.0 alpha0 Vulnerable ·plone

Remediation

  • Fix · CNA volto (plone) Fixed in 15.0.0-alpha.0
  • Fix · GHSA-cfhh-xgwq-5r67 @plone/volto (npm) Fixed in 15.0.0-alpha.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24740
  2. 2026-10-03 Alias added: GHSA-cfhh-xgwq-5r67

References

Patch 2

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences