What is GHSA-6247-7862-q2pq?

GHSA-6247-7862-q2pq is a security advisory published by GitHub Security Advisories with High severity. Apache Helix Front (UI) component contained a hard-coded secret

Which CVE IDs does GHSA-6247-7862-q2pq cover?

GHSA-6247-7862-q2pq covers the following CVE IDs: CVE-2024-22281. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6247-7862-q2pq?

GHSA-6247-7862-q2pq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-6247-7862-q2pq?

GHSA-6247-7862-q2pq affects 1 product, including: maven/org.apache.helix:helix:\u003c= 1.4.0.

GHSA-6247-7862-q2pqHighCVSS 7.5

Apache Helix Front (UI) component contained a hard-coded secret

Vendor

GitHub Security Advisories

Published

August 21, 2024

Last Modified

July 10, 2025

🔗 CVE IDs covered (1)

CVE-2024-22281 →

📋 Description

The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.

This issue affects Apache Helix Front (UI): all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

🎯 Affected products1

maven/org.apache.helix:helix:<= 1.4.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-22281
https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny
http://www.openwall.com/lists/oss-security/2024/08/20/3
https://github.com/advisories/GHSA-6247-7862-q2pq