CVSS 3.1
8.0 highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HCVE-2024-1052
High (8.0) in hashicorp boundary. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/boundary 0.15.0.
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:boundary
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vh73-q3rw-qx7w | Go | github.com/hashicorp/boundary | >=0.8.0 <0.15.0 | 0.15.0 |
| GO-2024-2532 | Go | github.com/hashicorp/boundary | >=0.8.0 <0.15.0 | 0.15.0 |