Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NConduit
APPConduit< 0.8.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-6303CRITICAL9.9PL ✓ten sam produkt
Brak autoryzacji w Conduit API umożliwia privilege escalation
CVE-2024-6302HIGH8.1ten sam produkt
Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local ...
CVE-2024-6299MEDIUM4.8ten sam produkt
Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has comp...
CVE-2024-6300LOW3.7ten sam produkt
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain string...