CVE-2024-23170
CVSS 3.1 Score 5.5 of 10 (medium)
Details
Summary
CVE-2024-23170 is a vulnerability discovered in Mbed TLS versions 2.x before 2.28.7 and 3.x before 3.5.2. This vulnerability allows a local attacker to recover plaintext by exploiting a timing side channel in RSA private operations. The attacker needs to send a large number of messages for decryption. The affected products include nXwejB, nXwejC, nXwejD, nXwejE, and others. To remediate this vulnerability, it is recommended to update Mbed TLS to version 2.28.7 or 3.5.2 or later. This vulnerability poses a medium risk as it has a base score of 5.5 and high confidentiality impact according to the Common Vulnerability Scoring System (CVSS) assessment provided by NIST (National Institute of Standards and Technology).
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions