Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@valtimo/components

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8npmAmendedPublished

    @valtimo/components exposes access token to form.io

    CVE-2024-34706 · GHSA-xcp4-62vj-cq3r

    Affected
    • npm @valtimo/components < 10.8.4; >= 11.0.0, < 11.1.6; >= 11.2.0, < 11.2.2
    Fixed in
    11.2.211.1.610.8.4· Vendor fix available
    Issue
    Impact When opening a form in Valtimo, the access token (JWT) of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. Attack requirements The following conditions have to be met in order to perform this attack: - An attacker needs to have access to the network traffic on the api.form.io domain. - The content of the x-jwt-token header is logged or otherwise available to the attacker. - An attacker needs to have network access to the Valtimo API. - An attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. Patches Versions 10.8.4, 11.1.6 and 11.2.2 have been patched

    Recommended action: Upgrade to 11.2.2, 11.1.6 or 10.8.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →