PT-2024-37524 · Conduit · Conduit

Published 2024-06-25 · Updated 2024-09-20 · CVE-2024-6302

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Conduit versions v0.6.0 and lower

Description: The issue is related to a lack of privilege checking when processing a redaction, allowing a local user to redact any message from users on the same server if they can send redaction events.

Recommendations: For Conduit versions v0.6.0 and lower, consider restricting access to redaction events to prevent unauthorized message redaction until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2024-6302

Affected Products

Conduit

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6302.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6302 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6302 · Vendor Advisory
• https://t.me/cvenotify/84379 · Telegram Post
• https://conduit.rs/changelog/#v0-7-0-2024-04-25 · Note
• https://t.me/cvenotify/84356 · Telegram Post
• https://gitlab.com/famedly/conduit/-/releases/v0.7.0 · Note
• https://t.me/cvenotify/95494 · Telegram Post