CVE-2024-1052

Fixed upstream EPSS <1%CVSS 8.0

Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.

Published 2024-02-05 · CVE record · OSV

Products: HashiCorp Boundary, HashiCorp Boundary Enterprise

Fixed upstream