A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.
References
Configurations
No configuration.
History
03 Sep 2024, 12:59
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
30 Aug 2024, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-08-30 22:15
Updated : 2024-09-03 12:59
NVD link : CVE-2024-8285
Mitre link : CVE-2024-8285
CVE.ORG link : CVE-2024-8285
JSON object : View
Products Affected
No product.
CWE
CWE-297
Improper Validation of Certificate with Host Mismatch