CVE-2024-6302 Improper Handling of Insufficient Permissions or Privileges in Conduit
A local user can redact any message from other users on the same server due to missing privilege checks in Conduit.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6302?
CVE-2024-6302 is a high-severity missing authorization vulnerability in The Conduit Contributors Conduit, published on 25 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same server, given that they are able to send redaction events.
Weakness: CWE-280
Which versions are affected by CVE-2024-6302?
It affects 1 product.
Products include Conduit Conduit.
How do I fix CVE-2024-6302?
No fix has been published for CVE-2024-6302 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-6302 being exploited?
There is no known exploitation of CVE-2024-6302 in the wild and no public exploit code.
Other vulnerabilities in The Conduit Contributors Conduit
Sources
Also known as GHSA-66x4-8gf5-hmj9.