Key Exchange without Entity Authentication

CVE-2024-47519

High

8.3/10

Summary

Backup uploads to ETM subject to man-in-the-middle interception

Attack Complexity: LOW
Attack Vector: NETWORK
Integrity Impact: HIGH
Scope: UNCHANGED
User Interaction: NONE
Privileges Required: LOW
Confidentiality Impact: HIGH
Availability Impact: LOW

CWE-322 - Key Exchange without Entity Authentication

The software performs a key exchange with an actor without verifying the identity of that actor.

References

Advisory Timeline

Published Jan 10, 2025