Security Resilience

CVE-2024-22281

Apache Helix

Published
20 August 2024
Modified
10 July 2025
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0073 53th percentile
Risk Priority 59 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-22281 is a high-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Apache Helix. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front (UI): all versions. As this project is…

more

retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CWE(s)
CWE-668

Related Threats

CVEs Like This One

CVE-2023-38647Same product: Apache Helix
CVE-2026-57111Same product: Apache Helix
CVE-2026-32690Same vendor: Apache
CVE-2023-31103Same vendor: Apache
CVE-2023-34189Same vendor: Apache
CVE-2023-31206Same vendor: Apache
CVE-2024-40725Same vendor: Apache
CVE-2023-42792Same vendor: Apache
CVE-2026-34538Same vendor: Apache
CVE-2023-48291Same vendor: Apache

Affected Assets

apache
helix
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access enforcement directly stops resources from being reachable by actors outside the intended control sphere.

AC-4 Information Flow Enforcement good match

Information flow enforcement structurally prevents unintended cross-sphere data or resource exposure.

AC-6 Least Privilege good match

Least privilege reduces the set of actors that can reach a resource, limiting wrong-sphere exposure.

AC-16 Security and Privacy Attributes partial match

Security attributes enable correct sphere assignment and subsequent enforcement decisions.

SC-7 Boundary Protection partial match

Boundary protection at interfaces prevents resources from being exposed outside authorized spheres.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-668, a class-level weakness. Rules are authored against its narrower children: CWE-427, CWE-552.

References