Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-41255

Date: July 30, 2024

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.

Language: Go

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2024-41255
https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_backend_ftp/index.go#L108
https://github.com/mickael-kerjean/filestash
https://pkg.go.dev/vuln/GO-2024-3033
https://github.com/mickael-kerjean/filestash/issues/710
https://gist.github.com/nyxfqq/c367f2ca9448810924dcf0f1af30b441
https://github.com/advisories/GHSA-4jmm-c6jw-g796
https://www.mend.io/vulnerability-database/CVE-2024-41255

Severity Score

Weakness Type (CWE)

Improper Certificate Validation

CWE-295

Insecure Default Variable Initialization

CWE-453

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us