CVE-2024-1052: falha de alta gravidade em HashiCorp Boundary
Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8epss 0.3%
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVEs relacionadas — HashiCorp Boundary
No mesmo produto, das mais perigosas para as menos.
CVE-2023-0690MEDIUMBoundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service ConfiguredEPSS 0.4%CVE-2024-12289MEDIUMBoundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceEPSS 0.4%CVE-2026-13303HIGHBoundary vulnerable to server-side request forgery in Vault credential storeEPSS 0.2%CVE-2026-7776HIGHBoundary Workers Vulnerable to Denial of Service During TLS HandshakeEPSS 0.2%