CVE-2024-37370
HIGHMIT Kerberos 5 < 1.21.3 - Data Authenticity Bypass
Title source: ruleDescription
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
Scores
CVSS v3
7.5
EPSS
0.0054
EPSS Percentile
67.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Classification
CWE
CWE-345
Status
published
Affected Products (1)
mit/kerberos_5
< 1.21.3
Timeline
Published
Jun 28, 2024
Tracked Since
Feb 18, 2026