CVE-2024-8285

Oct. 1, 2024, 1:15 p.m.

CVSS Score

5.9 / 10

Products Impacted

Vendor Product Versions
redhat
  • kroxylicious
  • -

Description

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.

Weaknesses

CWE-295
Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

CWE ID: 295
CWE-297
Improper Validation of Certificate with Host Mismatch

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

CWE ID: 297

Date

Published: Aug. 30, 2024, 10:15 p.m.

Last Modified: Oct. 1, 2024, 1:15 p.m.

Status : Modified

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a redhat kroxylicious - / / / / / / /

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

Base Score
5.9
Exploitability Score
0.7
Impact Score
5.2
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References