Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-y6qa-66p8-nkfe
Vulnerability ID VCID-y6qa-66p8-nkfe
Aliases CVE-2022-24721
GHSA-rjmq-6v55-4rjv
Summary CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-863 Incorrect Authorization
CWE-1220 Insufficient Granularity of Access Control
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24721.json
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2022-24721
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rjmq-6v55-4rjv
cvssv3.1 8.1 https://github.com/cometd/cometd
generic_textual HIGH https://github.com/cometd/cometd
cvssv3.1 8.1 https://github.com/cometd/cometd/commit/bb445a143fbf320f17c62e340455cd74acfb5929
generic_textual HIGH https://github.com/cometd/cometd/commit/bb445a143fbf320f17c62e340455cd74acfb5929
cvssv3.1 8.1 https://github.com/cometd/cometd/issues/1146
generic_textual HIGH https://github.com/cometd/cometd/issues/1146
ssvc Track https://github.com/cometd/cometd/issues/1146
cvssv3.1 8.1 https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
cvssv3.1_qr HIGH https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
generic_textual HIGH https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
ssvc Track https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2022-24721
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-24721
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24721.json
https://api.first.org/data/v1/epss?cve=CVE-2022-24721
https://github.com/cometd/cometd
https://github.com/cometd/cometd/commit/bb445a143fbf320f17c62e340455cd74acfb5929
1146 https://github.com/cometd/cometd/issues/1146
2064616 https://bugzilla.redhat.com/show_bug.cgi?id=2064616
CVE-2022-24721 https://nvd.nist.gov/vuln/detail/CVE-2022-24721
GHSA-rjmq-6v55-4rjv https://github.com/advisories/GHSA-rjmq-6v55-4rjv
GHSA-rjmq-6v55-4rjv https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24721.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/cometd/cometd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/cometd/cometd/commit/bb445a143fbf320f17c62e340455cd74acfb5929
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/cometd/cometd/issues/1146
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:55:05Z/ Found at https://github.com/cometd/cometd/issues/1146
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:55:05Z/ Found at https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-24721
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.39099
EPSS Score 0.00177
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:41:20.807054+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/24xxx/CVE-2022-24721.json 38.6.0