CVE-2024-35061

HIGH

NASA AIT-Core < 2.5.2 - Missing Encryption of Sensitive Data

Title source: llm
STIX 2.1

Description

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, fully remote code execution.

References (3)

Core 3

Scores

CVSS v3 7.3
EPSS 0.0055
EPSS Percentile 41.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-311
Status published
Products (2)
nasa/ait_core < 2.5.2
pypi/ait-core 0PyPI
Published May 21, 2024
Tracked Since Feb 18, 2026