CVE-2024-1052
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Boundary
- Vendor
- HashiCorp
- Product
- Boundary
- Platforms
- Windows
- MacOS
- Linux
- x86
- ARM
- 64 bit
- 32 bit
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0.8.0 | affected | semver | 0.15.0 | Unavailable | None listed |
Boundary Enterprise
- Vendor
- HashiCorp
- Product
- Boundary Enterprise
- Platforms
- Windows
- MacOS
- Linux
- x86
- ARM
- 64 bit
- 32 bit
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0.8.0 | affected | semver | 0.15.0 | Unavailable | None listed |