CVE-2024-6299

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-324

Affected software

Vendor	Product	Versions
The Conduit Contributors	Conduit	< 0.8.0

References

https://conduit.rs/changelog/#v0-8-0-2024-06-12Release Notes
https://gitlab.com/famedly/conduit/-/releases/v0.8.0Release Notes
https://conduit.rs/changelog/#v0-8-0-2024-06-12Release Notes
https://gitlab.com/famedly/conduit/-/releases/v0.8.0Release Notes

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-63005.3Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU befo CVE-2024-63017.5Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs CVE-2024-63025.5Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message fro CVE-2024-63038.8Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be CVE-2024-63076.4WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sa CVE-2024-63089.8A vulnerability was found in itsourcecode Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability a CVE-2024-63098.8The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions u CVE-2024-63108.8The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, a CVE-2024-63117.2The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' CVE-2024-63126.5The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af CVE-2024-63139.8The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the CVE-2024-63149.8The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process_im