← Vulnerability feed

Vulnerability record · CVE-2024-22281 · published 20 August 2024

CVE-2024-22281: Apache helix exposure of resource to wrong sphere vulnerability

Apache · Helix

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front (UI): all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

7.5 CVSS 3.1 High EPSS 0.73% · top 47.7% CWE-668 · Exposure of resource to wrong sphere
7.5CVSS 3.1 base score
0.73%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front (UI): all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2024/08/20/3 Mailing ListThird Party Advisory

Track CVE-2024-22281 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-38647Apache helix deserialization of untrusted data vulnerabilityAn attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.S…EPSS 2.0%7.5CVE-2026-57111Apache helix vulnerabilityPermissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through…EPSS 0.35%6.1CVE-2022-47500Apache helix open redirect vulnerabilityURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache H…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2024-22281), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.