CVE-2024-38367

🗓️ 01 Jul 2024 21:15:04Reported by [email protected]Type

Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, trunk.cocoapods.org authentication server was vulnerable to owner session hijacking, allowing full CocoaPods trunk account takeover

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of dependency managers for Swift and Objective-C CocoaPods, related to the provision of data elements during an erroneous session, allows a perpetrator to intercept the owner’s session and take control of another person’s CocoaPods trunk account.	29 Jul 202400:00	–	bdu_fstec
Circl	CVE-2024-38367	2 Jul 202416:00	–	circl
CNNVD	CocoaPods Security Vulnerability	1 Jul 202400:00	–	cnnvd
CVE	CVE-2024-38367	1 Jul 202420:48	–	cve
Cvelist	CVE-2024-38367 CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking	1 Jul 202420:48	–	cvelist
EUVD	EUVD-2024-37281	3 Oct 202520:07	–	euvd
OSV	CVE-2024-38367 CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking	1 Jul 202420:48	–	osv
Positive Technologies	PT-2024-5209 · Cocoapods · Cocoapods	1 Jul 202400:00	–	ptsecurity
The Hacker News	Critical Flaws in CocoaPods Expose iOS and macOS Apps to Supply Chain Attacks	1 Jul 202416:12	–	thn
Vulnrichment	CVE-2024-38367 CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking	1 Jul 202420:48	–	vulnrichment

NVD

Node

cocoapods trunk.cocoapods.orgRange<2023-10-27ruby

Source	Link
evasec	www.evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods
github	www.github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333
blog	www.blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023
github	www.github.com/CocoaPods/trunk.cocoapods.org/commit/d4fa66f49cedab449af9a56a21ab40697b9f7b97

21 Nov 2024 09:25Current

CVSS 3.18.2 - 9.6

EPSS0.04993

CWE-488