High severity · published Sep 18, 2024
CVE-2024-8287
Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Anbox Cloud · Canonical
1.17.0 before 1.23.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8287
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8287
Vendor Advisory
https://bugs.launchpad.net/anbox-cloud/+bug/2077570
Release Notes
https://discourse.ubuntu.com/t/anbox-cloud-1-23-1-has-been-released/48141
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-8287