VDB
CISA-2024-52801
CISA-2024-52801
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published November 29, 2024
sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| drakkan | sftpgo | >= 2.3.0, < 2.6.4 |
| drakkan | sftpgo | >= 2.3.0, < 2.6.4, >= 2.3.0, < 2.6.4 |
Timeline
- Nov 29, 2024 CVE Published
- Dec 2, 2024 CVE Updated
References
- https://github.com/drakkan/sftpgo/security/advisories/GHSA-6943-qr24-82vx x_refsource_CONFIRM
- https://github.com/drakkan/sftpgo/commit/f30a9a2095bf90c0661b04fe038e3b7efc788bc6 x_refsource_MISC
- https://github.com/rs/xid x_refsource_MISC