CVE-2024-22859

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Feb 1, 2024

Updated: Aug 1, 2024

CWE ID 352

Summary

CVE-2024-22859 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Livewire before version 3.0.4. This issue allows remote attackers to execute arbitrary code through the getCsrfToken function. However, the vendor has disputed this, claiming that the fix in commit 5d88731 addressed a usability problem with HTTP 419 status codes, rather than a security vulnerability. Despite this disagreement, it's essential for users to upgrade to the latest version of Livewire to mitigate potential risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Livewire

Affected Vendors

LiveWire

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/uGxrFc
https://www.cve.org/CVERecord?id=CVE-2024-22859
https://nvd.nist.gov/vuln/detail/CVE-2024-22859

Back to Vulnerability Database