Lucene search

GitLabCVE-2024-6302

HistoryJun 25, 2024 - 1:15 p.m.

CVE-2024-6302

2024-06-2513:15:51

CWE-280

GitLab

web.nvd.nist.gov

privilege checking

conduit

redaction event

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

9.1%

JSON

Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same server, given that they are able to send redaction events.

Affected configurations

Nvd

Vulners

Node

conduitconduitRange<0.7.0

VendorProductVersionCPE
conduitconduit*cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
conduit	conduit	*	cpe:2.3:a:conduit:conduit::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Conduit",
    "vendor": "The Conduit Contributors",
    "versions": [
      {
        "lessThan": "0.7.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

conduit.rs/changelog/#v0-7-0-2024-04-25

gitlab.com/famedly/conduit/-/releases/v0.7.0

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

9.1%

JSON

Related for CVE-2024-6302