VULNERABILITY INTELLIGENCE

CVE-2024-6299

CVSS score4.8 MEDIUM
EPSS probability0.16%
CISA KEVNot currently listed
Published2024-06-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date

Weakness classification

  • cve@gitlab.com: CWE-324
  • nvd@nist.gov: NVD-CWE-Other

Primary references