GitHub Advisoryadvisory · Go

GHSA-r6qh-j42j-pw64 Beego privilege escalation vulnerability

HIGH Published 2024-07-31 Modified 2024-08-06 Official page ↗
Aliases
CVE-2024-40464
Ecosystem
Go
Packages
github.com/beego/beego/v2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295, CWE-599
Reviewed
2024-08-01

Affected packages

• Go github.com/beego/beego/v2: < 2.2.1 → fixed in 2.2.1

Description

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the `sendMail` function located in the `beego/core/logs/smtp.go` file.

Related

Alias · CVE (1)

  • CVE-2024-40464 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in… vulnerability

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-599 Missing Validation of OpenSSL Certificate weakness

References