CVE-2024-38368

Katalog CVE

CVSS 9.3 · Critical EPSS 14,9%

Kerentanan Exposure of Resource to Wrong Sphere pada trunk.cocoapods.org. Skor CVSS 3.1 9.3 (Critical) menurut NVD.

Deskripsi (NVD)

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.

Rincian

Terbit di NVD

1 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.3 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

14,9% peluang dieksploitasi; lebih tinggi dari 96,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 advisory vendor
• https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 patch
• https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ow... advisory pihak ketiga
• https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx advisory pihak ketiga
• https://blog.cocoapods.org/Claim-Your-Pods product