CVE-2022-24781

{"containers": {"cna": {"affected": [{"product": "Geon", "vendor": "math-geon", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "descriptions": [{"lang": "en", "value": "Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-384", "description": "CWE-384: Session Fixation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-03-24T20:25:10.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0"}], "source": {"advisory": "GHSA-4fv9-g2jh-j5xm", "discovery": "UNKNOWN"}, "title": "Malicious users can take over the session of other players", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24781", "STATE": "PUBLIC", "TITLE": "Malicious users can take over the session of other players"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Geon", "version": {"version_data": [{"version_value": "< 1.1.0"}]}}]}, "vendor_name": "math-geon"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-384: Session Fixation"}]}]}, "references": {"reference_data": [{"name": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm", "refsource": "CONFIRM", "url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm"}, {"name": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19", "refsource": "MISC", "url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19"}, {"name": "https://github.com/math-geon/Geon/releases/tag/v1.1.0", "refsource": "MISC", "url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0"}]}, "source": {"advisory": "GHSA-4fv9-g2jh-j5xm", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.516Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T14:08:32.205970Z", "id": "CVE-2022-24781", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T18:43:55.676Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24781", "datePublished": "2022-03-24T20:25:10.000Z", "dateReserved": "2022-02-10T00:00:00.000Z", "dateUpdated": "2025-04-23T18:43:55.676Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.516Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-24781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T14:08:32.205970Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:08:33.882Z"}}], "cna": {"title": "Malicious users can take over the session of other players", "source": {"advisory": "GHSA-4fv9-g2jh-j5xm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "math-geon", "product": "Geon", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "references": [{"url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384: Session Fixation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-03-24T20:25:10.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, "source": {"advisory": "GHSA-4fv9-g2jh-j5xm", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "< 1.1.0"}]}, "product_name": "Geon"}]}, "vendor_name": "math-geon"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm", "name": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm", "refsource": "CONFIRM"}, {"url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19", "name": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19", "refsource": "MISC"}, {"url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0", "name": "https://github.com/math-geon/Geon/releases/tag/v1.1.0", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-384: Session Fixation"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-24781", "STATE": "PUBLIC", "TITLE": "Malicious users can take over the session of other players", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-24781", "state": "PUBLISHED", "dateUpdated": "2025-04-23T18:43:55.676Z", "dateReserved": "2022-02-10T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-03-24T20:25:10.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Geon", "vendor": "math-geon", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:geon_project:geon:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "8B63C197-3AA7-4D4F-88AE-F1A60B718CAE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists."}, {"lang": "es", "value": "Geon es un juego de mesa basado en la resoluci\u00f3n de preguntas sobre el Teorema de Pit\u00e1goras. Unos usuarios maliciosos pueden obtener el uuid de otros usuarios, falsificar ese uuid mediante la consola del navegador y convertirse en copropietarios de la sesi\u00f3n de destino. Este problema est\u00e1 parcheado en la versi\u00f3n 1.1.0. No se presenta ninguna medida de mitigaci\u00f3n conocida"}], "id": "CVE-2022-24781", "lastModified": "2026-06-17T04:32:30.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-24781", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T14:08:32.205970Z", "version": "2.0.3"}}]}, "published": "2022-03-24T21:15:13.850", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/math-geon/Geon/releases/tag/v1.1.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}