GitHub Advisoryadvisory · Go
GHSA-mpvx-whpp-99xj Filestash skips TLS certificate verification process when sending out email verification codes
HIGH
Official page ↗
- Aliases
- CVE-2024-41256
- Ecosystem
- Go
- Packages
- github.com/mickael-kerjean/filestash
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-295
- Reviewed
- 2024-08-02
Affected packages
• Go github.com/mickael-kerjean/filestash: <= 0.4 (no fix yet)
Description
Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.
Related
Alias · CVE (1)
- CVE-2024-41256 Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification… vulnerability
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-41256 advisory
- https://github.com/mickael-kerjean/filestash/issues/709 web
- https://gist.github.com/nyxfqq/a6da3fe6128b978ea1aaa5df639d5f98 web
- https://github.com/mickael-kerjean/filestash package
- https://github.com/mickael-kerjean/filestash/blob/master/server/model/share.go#L132 web
- https://pkg.go.dev/vuln/GO-2024-3035 web