CVE-2024-28110

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Mar 6, 2024
Updated: Mar 7, 2024
CWE ID 522

Summary

CVE-2024-28110 is a vulnerability in the Go SDK for CloudEvents, affecting versions prior to 2.15.2. The vulnerability allows for the leakage of credentials to arbitrary endpoints when using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper. This occurs because when the transport is populated with an authenticated transport, the http.DefaultClient is modified and starts sending Authorization tokens to any endpoint it contacts. To remediate this issue, users should update to version 2.15.2 of the Go SDK for CloudEvents. This vulnerability poses a high risk to organizations as it can result in unauthorized access and compromise of sensitive information.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-28110 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options