GitHub Advisoryadvisory · Go

GHSA-hw5f-6wvv-xcrh SFTPGo has insufficient access control for password reset

MEDIUM Published 2024-06-20 Modified 2024-06-20 Official page ↗
Aliases
CVE-2024-37897
Ecosystem
Go
Packages
github.com/drakkan/sftpgo/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-287, CWE-863
Reviewed
2024-06-20

Affected packages

• Go github.com/drakkan/sftpgo/v2: >= 2.2.0, < 2.6.1 → fixed in 2.6.1

Description

Impact SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Patches Fixed in v2.6.1. Workarounds The following workarounds are available: • keep the password reset feature disabled. • Set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-37897 SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-863 Incorrect Authorization weakness

References