← Vulnerability feed

Vulnerability record · CVE-2024-38368 · published 1 July 2024

CVE-2024-38368: Trunk.cocoapods.org exposure of resource to wrong sphere vulnerability

Cocoapods · Trunk.Cocoapods.Org

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.

9.3 CVSS 3.1 Critical EPSS 15% · top 3.4% CWE-668 · Exposure of resource to wrong sphere
9.3CVSS 3.1 base score
15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.cocoapods.org/Claim-Your-Pods Product
https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 Vendor Advisory
https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-ov Third Party Advisory
https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx Third Party Advisory
https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 Patch
https://blog.cocoapods.org/Claim-Your-Pods Product
https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 Vendor Advisory
https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#1-taking-unauthorized-ownership-ov Third Party Advisory
https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-j483-qm5c-7hqx Third Party Advisory
https://github.com/CocoaPods/trunk.cocoapods.org/commit/71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 Patch

Track CVE-2024-38368 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-38366Trunk.cocoapods.org injection vulnerabilitytrunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real em…EPSS 18%9.6CVE-2024-38367Trunk.cocoapods.org vulnerabilitytrunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the…EPSS 11%

Source: NIST National Vulnerability Database (record CVE-2024-38368), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.