Lucene search

GitLabCVE-2024-6301

HistoryJun 25, 2024 - 1:15 p.m.

CVE-2024-6301

2024-06-2513:15:51

CWE-346

GitLab

web.nvd.nist.gov

conduit

federation api

origin validation

remote impersonation

edus

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

18.6%

JSON

Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs

Affected configurations

Nvd

Vulners

Vulnrichment

Node

conduitconduitRange<0.8.0

VendorProductVersionCPE
conduitconduit*cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
conduit	conduit	*	cpe:2.3:a:conduit:conduit::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Conduit",
    "vendor": "The Conduit Contributors",
    "versions": [
      {
        "lessThan": "0.8.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

conduit.rs/changelog/#v0-8-0-2024-06-12

gitlab.com/famedly/conduit/-/releases/v0.8.0

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

18.6%

JSON

Related for CVE-2024-6301