Incomplete Cleanup in Conduit
Priority LOW 24CWE-459Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed Conduit (The Conduit Contributors): 0.8.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Conduit Contributors | Conduit | before 0.8.0 | 0.8.0 | Patch available | CNA |
- Conduit VendorThe Conduit Contributors Affected before 0.8.0 Fixed in 0.8.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:* | before 0.8.0 | Vulnerable | The Conduit Contributors |
- cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:* Versions before 0.8.0 Vulnerable ·The Conduit Contributors
Remediation
- Fix · CNA Conduit (The Conduit Contributors) Fixed in 0.8.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Conduit Contributors Conduit 0.8.0
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2024-05850 Missing Authorization in ConduitPriority MEDIUM 43
- TI-2024-05848 Origin Validation Error in ConduitPriority LOW 38
- TI-2024-05846 Use of a Key Past its Expiration Date in ConduitPriority LOW 21
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6300
- 2026-10-03 Alias added: GHSA-wf6c-43pg-h78x
References
More The Conduit Contributors Conduit vulnerabilities
- TI-2024-05850 Missing Authorization in Conduit CVSS 3.1CRITICAL 9.9
- TI-2024-05848 Origin Validation Error in Conduit CVSS 3.1HIGH 7.5
- TI-2024-05849 Improper Handling of Insufficient Permissions or Privileges in Conduit CVSS 3.1HIGH 8.1
- TI-2024-05846 Use of a Key Past its Expiration Date in Conduit CVSS 3.1MEDIUM 4.8
Sources
- CVE-2024-6300 · CVE Program
- CVE-2024-6300 · NVD
- FIRST EPSS
- GHSA-wf6c-43pg-h78x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences