The Conduit Contributors Conduit
5 CVEs affecting The Conduit Contributors Conduit. Latest disclosed: 2024-06-25. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6303 | Critical | 9.9 | 2024-06-25 | Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege… |
CVE-2024-6302 | High | 8.1 | 2024-06-25 | Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same… |
CVE-2024-6301 | Medium | 5.3 | 2024-06-25 | Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs |
CVE-2024-6299 | Medium | 4.8 | 2024-06-25 | Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the r… |
CVE-2024-6300 | Low | 3.7 | 2024-06-25 | Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction |