« Volver al listado

CVE-2024-34706

Estado: AplazadaCrítica (9.8)—

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component.

The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token.

Leer descripción completaMostrar menos

The default TTL in Keycloak is 5 minutes.

Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Form IO — Form IOAIKeycloak — KeycloakAIValtimo — ValtimoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34706",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34706",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-14T01:31:47.573618Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "valtimo-platform",
          "product": "valtimo-frontend-libraries",
          "versions": [
            {
              "status": "affected",
              "version": "< 10.8.4"
            },
            {
              "status": "affected",
              "version": ">= 11.0.0, < 11.1.6"
            },
            {
              "status": "affected",
              "version": ">= 11.2.0, < 11.2.2"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:valtimo:frontend-libraries:*:*:*:*:*:*:*:*"
          ],
          "vendor": "valtimo",
          "product": "frontend-libraries",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "10.8.4",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:valtimo:frontend-libraries:11.2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "valtimo",
          "product": "frontend-libraries",
          "versions": [
            {
              "status": "affected",
              "version": "11.2.0",
              "lessThan": "11.2.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:valtimo:frontend-libraries:11.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "valtimo",
          "product": "frontend-libraries",
          "versions": [
            {
              "status": "affected",
              "version": "11.0.0",
              "lessThan": "11.1.6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-14T15:39:29.990",
  "references": [
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component.\n\nThe following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes.\n\nVersions 10.8.4, 11.1.6 and 11.2.2 have been patched."
    },
    {
      "lang": "es",
      "value": "Valtimo es una plataforma de gestión de casos y procesos empresariales de código abierto. Al abrir un formulario en Valtimo, el token de acceso (JWT) del usuario se expone a `api.form.io` a través del encabezado `x-jwt-token`. Un atacante puede recuperar información personal de este token o utilizarlo para ejecutar solicitudes a la API REST de Valtimo en nombre del usuario que ha iniciado sesión. Este problema se debe a una mala configuración del componente Form.io. Se deben cumplir las siguientes condiciones para realizar este ataque: Un atacante debe tener acceso al tráfico de red en el dominio `api.form.io`; el contenido del encabezado `x-jwt-token` está registrado o disponible de otro modo para el atacante; un atacante necesita tener acceso de red a la API de Valtimo; y un atacante debe actuar dentro del tiempo de vida del token de acceso. El TTL predeterminado en Keycloak es 5 minutos. Se han parcheado las versiones 10.8.4, 11.1.6 y 11.2.2."
    }
  ],
  "lastModified": "2026-06-17T07:33:54.720",
  "sourceIdentifier": "security-advisories@github.com"
}