THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-28872

Incorrect TLS certificate validation can lead to escalated privileges

Assignerisc
Reserved2024-03-12
Published2024-07-11
Updated2024-07-11

Description

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service (Kea or BIND 9), possibly resulting in confidential data loss and/or denial of service. It should be noted that this vulnerability is not related to BIND 9 or Kea directly, and only customers using the Stork management tool are potentially affected. This issue affects Stork versions 0.15.0 through 1.15.0.



HIGH: 8.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H

Product status

Default status
unaffected

0.15.0
affected

References

https://kb.isc.org/docs/cve-2024-28872 (CVE-2024-28872) vendor-advisory

cve.org CVE-2024-28872

nvd.nist.gov CVE-2024-28872

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-28872
© Copyright 2024 THREATINT. Made in Cyprus with +