CVE-2024-30564

Name of the Vulnerable Software and Affected Versions inandrei-tatar nora-firebase-common versions 1.0.41 through 1.12.2

Description The issue allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal() method. This enables the attacker to cause a state issue.

Recommendations For versions 1.0.41 through 1.12.2, apply the latest security patch to mitigate the issue. As a temporary workaround, consider restricting access to the updateStateInternal() method until a patch is available. Avoid using the updateState parameter in the affected method until the issue is resolved.