CVE-2024-31999
CVSS 3.1 Score 7.4 of 10 (high)
Details
Summary
CVE-2024-31999 is a secondary type cyber vulnerability that affects @festify/secure-session, a package used for creating secure stateless cookie sessions in Fastify. The vulnerability occurs during the session removal process, where the session is marked for deletion but not completely removed. If an attacker gains access to the encrypted cookie, they can keep accessing the session data. The base severity of this vulnerability is high, with a score of 7.4 out of 10. It requires user interaction and can lead to a confidentiality impact, potentially posing a danger to organizations using this package. Remediation steps should include updating to the latest version of @festify/secure-session that fixes the issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions