CVE-2024-8287CWE-295

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent

High · published September 18, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.7th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-09-18T18:35Z
EPSS history
Timeline
  • 18 SEP 18:35Z
    Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent
    cvelistv5