CVE-2024-2048

Summary

CVE-2024-2048 is a vulnerability affecting Vault and Vault Enterprise ("Vault") that allows an attacker to bypass authentication using a maliciously crafted certificate. This issue arises when Vault incorrectly validates client certificates when a non-Certifying Authority (CA) certificate is configured as trusted. Consequently, an attacker could present a false certificate to gain unauthorized access. The vulnerability is addressed in Vault versions 1.15.5 and 1.14.10.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.