CVE-2024-6834

A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.

• CWE-250

• https://github.com/zowe/api-layer
• https://github.com/zowe/api-layer

Published

Jul 17, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6828The Redux Framework plugin for WordPress is vulnerable to un…7.2
• CVE-2024-6829A vulnerability in aimhubio/aim version 3.19.3 allows an att…9.1
• CVE-2024-6830A vulnerability, which was classified as critical, was found…7.5
• CVE-2024-6831Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Pro…4.4
• CVE-2024-6832The account locking mechanism fails to trigger when secondar…7.5
• CVE-2024-6833A vulnerability in Zowe CLI allows local, privileged actors …5.9
• CVE-2024-6835The Ivory Search – WordPress Search Plugin plugin for WordPr…5.3
• CVE-2024-6836The Funnel Builder for WordPress by FunnelKit – Customize Wo…4.3
• CVE-2024-6838In mlflow/mlflow version v2.13.2, a vulnerability exists tha…5.3
• CVE-2024-6839corydolphin/flask-cors version 4.0.1 contains an improper re…5.3
• CVE-2024-6840An improper authorization flaw exists in the Ansible Automat…6.6
• CVE-2024-6841A Cross-Site Request Forgery (CSRF) vulnerability exists in …6.5