Skip to content
Fencer Vulns
critical 9.8

CVE-2024-34706 json

@valtimo/components exposes access token to form.io

published 2024-05-13 2 y ago modified 2026-09-10 1 mo ago also GHSA-xcp4-62vj-cq3r , EUVD-2024-1859

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component.

The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes.

Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.

Patch / fix

  • npm @valtimo/components 10.8.4, 11.1.6, 11.2.2
  • valtimo frontend-libraries 10.8.4, 11.1.6, 11.2.2

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm @valtimo/components
<10.8.4
>=11.0.0, <11.1.6
>=11.2.0, <11.2.2
10.8.4
11.1.6
11.2.2

Affected products

  • valtimo-platform valtimo-frontend-libraries
  • valtimo frontend-libraries

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.