Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NConduit
APPConduit< 0.8.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-6303CRITICAL9.9PL ✓same product
Brak autoryzacji w Conduit API umożliwia privilege escalation
CVE-2024-6302HIGH8.1same product
Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local ...
CVE-2024-6301MEDIUM5.3same product
Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user ...
CVE-2024-6300LOW3.7same product
Niekompletne czyszczenie podczas wykonywania redakcji w Conduit, umożliwiające atakującemu sprawdzenie, czy ok...