Valtimo Frontend Libraries
Approved changes feed: RSS · Atom
cpe:2.3:a:valtimo-platform:valtimo-frontend-libraries:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Valtimo Platform (22bee16e-90cb-5111-8925-edc0030b6f3d) |
|---|---|
| Product | Valtimo Frontend Libraries (39f8ca98-009b-528b-aea8-d3d9fc1253bb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-34706 |
vulnerable | 2026-06-08 06:37:34.886330 |
@valtimo/components exposes access token to form.io
CRITICAL (9.8)
Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component.
The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes.
Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.
Published: 2024-05-13T16:02:28.694Z
Updated: 2024-08-02T02:59:21.978Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.