CVE-2024-28872
HIGH EPSS 20.7%
Published Jul 11, 20241y ago · Modified Jun 17, 20261w ago
8.1 CVSS 3.1
Published Jul 11, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
Description
The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service (Kea or BIND 9), possibly resulting in confidential data loss and/or denial of service. It should be noted that this vulnerability is not related to BIND 9 or Kea directly, and only customers using the Stork management tool are potentially affected. This issue affects Stork versions 0.15.0 through 1.15.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
20.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-295
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| isc | stork | * | ≥0.15.0 – <1.15.1 |
References 1
- kb.isc.org https://kb.isc.org/docs/cve-2024-28872
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.