CVE-2024-6156

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
Canonical Ltd.LXD>= 4.0, < 4.0.10; >= 4.0, < 5.0.4; >= 4.0, < 5.21.2; >= 4.0, < 6.1
canonicallxd< 5.21.2

References

Timeline

Published
Dec 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-61575.1An attacker who successfully exploited these vulnerabilities could cause the robot to stop. A vulnerability exists in the PROFINET stack CVE-2024-61584.8The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validCVE-2024-61599.8The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using iCVE-2024-61609.3SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify tCVE-2024-61618.8The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cachCVE-2024-61627.5A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. ThiCVE-2024-61635.3Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication CVE-2024-61649.8The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possiblCVE-2024-61654.8The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users suchCVE-2024-61668.8The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via thCVE-2024-61674.3The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on severCVE-2024-61684.3The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is
CVE-2024-6156: Low severity, CVSS 3.8 | Vulnix