Beveiligingsadvies

CVE-2026-41860

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-04 01:40:23

Laatst bijgewerkt 2026-06-04 12:46:24

Toegewezen door vmware

CVSS-score 8.8

Status PUBLISHED

Beschrijving

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials. Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

← Alle CVE's bekijken Bekijk op cve.org ↗