Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NFilestash
APPFilestash≤ 0.4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Powiązane podatności
CVE-2024-41255HIGH7.5ten sam produkt
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allow...
CVE-2024-41258MEDIUM5.3ten sam produkt
An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key veri...