Vulnerability Details CVE-2024-1052
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 49.2%
CVSS Severity
CVSS v3 Score 8.0
References
Products affected by CVE-2024-1052
-
cpe:2.3:a:hashicorp:boundary:0.10.0
-
cpe:2.3:a:hashicorp:boundary:0.10.1
-
cpe:2.3:a:hashicorp:boundary:0.10.2
-
cpe:2.3:a:hashicorp:boundary:0.10.3
-
cpe:2.3:a:hashicorp:boundary:0.10.4
-
cpe:2.3:a:hashicorp:boundary:0.10.5
-
cpe:2.3:a:hashicorp:boundary:0.11.0
-
cpe:2.3:a:hashicorp:boundary:0.11.1
-
cpe:2.3:a:hashicorp:boundary:0.11.2
-
cpe:2.3:a:hashicorp:boundary:0.12.0
-
cpe:2.3:a:hashicorp:boundary:0.8.0
-
cpe:2.3:a:hashicorp:boundary:0.8.1
-
cpe:2.3:a:hashicorp:boundary:0.9.0
-
cpe:2.3:a:hashicorp:boundary:0.9.1