Cyber Resilience

CVE-2024-22186

Published
18 April 2024
Modified
15 April 2026
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0055 43th percentile
Risk Priority 39 floored blend · peak EPSS

Summary

CVE-2024-22186 is a high-severity Reliance on Cookies without Validation and Integrity Checking (CWE-565) vulnerability in Cisa (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability Data

The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator.

CWE(s)
CWE-565

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-21872Shared CWE-565
CVE-2026-5130Shared CWE-565
CVE-2024-9970Shared CWE-565
CVE-2025-31120Shared CWE-565
CVE-2025-2395Shared CWE-565
CVE-2025-48980Shared CWE-565
CVE-2023-41084Shared CWE-565
CVE-2025-64447Shared CWE-565
CVE-2024-55211Shared CWE-565
CVE-2025-14440Shared CWE-565

Affected Assets

Cisa
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access Enforcement requires authorizations to be enforced by the system rather than by trusting client-supplied cookie values.

SC-23 Session Authenticity good match

Session Authenticity directly requires protecting the integrity and authenticity of session tokens such as cookies, eliminating blind reliance on them.

SC-8 Transmission Confidentiality and Integrity partial match

Transmission Confidentiality and Integrity mandates cryptographic or equivalent protection for data in transit, which covers cookie values exchanged over HTTP.

SI-7 Software, Firmware, and Information Integrity partial match

Software, Firmware, and Information Integrity can detect unauthorized modification of cookie-based data after the fact via integrity verification.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.

PR.DS-02 mostly match
prevents

Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.

PR.AA-05 partial match
prevents

Enforcing access policy and least privilege limits damage from cookie misuse but does not address cookie validation itself.

PR.DS-01 partial match
prevents

Integrity protections for data-at-rest can apply to cookie stores but do not cover validation during use.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect cookie-validation flaws but does not itself implement the required controls.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate cookie validation, integrity protection, and server-side session handling.

A.8.28 Secure coding partial match
prevents

Secure coding practices directly eliminate reliance on unvalidated cookies by requiring proper integrity checks and server-side verification.

A.8.5 Secure authentication partial match
prevents

Secure authentication mechanisms can enforce server-side validation and integrity checks that prevent reliance on untrusted cookies.

References