CVSS 3.1 Score 7.5 of 10 (high)


Published Jan 25, 2024
Updated: Jan 31, 2024
CWE ID 757
CWE ID 326


CVE-2024-23656 is a cyber vulnerability that affects Dex, an identity service using OpenID Connect for authentication. In version 2.37.0 of Dex, insecure TLS 1.0 and TLS 1.1 are used for HTTPS, despite seemingly setting TLS 1.2 as the minimum version in the code. This issue is not addressed due to the introduction of the "TLS cert reloader" in v2.37.0, which ignores the entire tlsConfig. Additionally, configured cipher suites are not respected. The vulnerability is fixed in Dex version 2.38.0. This vulnerability has a base severity rating of HIGH with a base score of 7.5 according to NIST's National Vulnerability Database (NVD). It poses a potential danger to organizations as it allows for network-based attacks and can lead to high confidentiality impact, although it does not require any special privileges or user interaction to exploit it.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23656 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options