CVE-2024-38368: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014…

PriorityP268critical9.3CVSS 3.1

AVNACLPRNUINSCCNIHAL

EPSS

14.85%

96.3th percentile

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cocoapods	cocoapods	< 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4	71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4
cocoapods	trunk.cocoapods.org	< 2023-09-22	2023-09-22

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.