CVE-2024-6301

MEDIUM

Conduit 0.8.0 - Federation User Impersonation via Origin Validation Bypass

Title source: manual
STIX 2.1

Description

Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0017
EPSS Percentile 6.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-346
Status published
Products (1)
conduit/conduit < 0.8.0
Published Jun 25, 2024
Tracked Since Feb 18, 2026