CVE-2024-23656
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-23656 is a cyber vulnerability that affects Dex, an identity service using OpenID Connect for authentication. In version 2.37.0 of Dex, insecure TLS 1.0 and TLS 1.1 are used for HTTPS, despite seemingly setting TLS 1.2 as the minimum version in the code. This issue is not addressed due to the introduction of the "TLS cert reloader" in v2.37.0, which ignores the entire tlsConfig. Additionally, configured cipher suites are not respected. The vulnerability is fixed in Dex version 2.38.0. This vulnerability has a base severity rating of HIGH with a base score of 7.5 according to NIST's National Vulnerability Database (NVD). It poses a potential danger to organizations as it allows for network-based attacks and can lead to high confidentiality impact, although it does not require any special privileges or user interaction to exploit it.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions