CVE-2024-38367

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-38367

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38367.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-38367

Aliases

GHSA-52gf-m7v9-m333

Published

2024-07-01T20:48:06.861Z

Modified

2026-04-02T12:16:53.796918Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H CVSS Calculator

Summary

CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking

Details

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-488"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38367.json"
}

References

Affected packages

Git / github.com/cocoapods/trunk.cocoapods.org

Affected ranges

Type: GIT
Repo: https://github.com/cocoapods/trunk.cocoapods.org
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d4fa66f49cedab449af9a56a21ab40697b9f7b97

Type: GIT
Repo: https://github.com/cocoapods/trunk.cocoapods.org
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d4fa66f49cedab449af9a56a21ab40697b9f7b97

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38367.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2023-10-27"
            }
        ]
    }
]