What is GHSA-mpvx-whpp-99xj?

GHSA-mpvx-whpp-99xj is a security advisory published by GitHub Security Advisories with High severity. Filestash skips TLS certificate verification process when sending out email verification codes

Which CVE IDs does GHSA-mpvx-whpp-99xj cover?

GHSA-mpvx-whpp-99xj covers the following CVE IDs: CVE-2024-41256. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mpvx-whpp-99xj?

GHSA-mpvx-whpp-99xj has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-mpvx-whpp-99xj?

GHSA-mpvx-whpp-99xj affects 1 product, including: go/github.com/mickael-kerjean/filestash:\u003c= 0.4.

GHSA-mpvx-whpp-99xjHighCVSS 8.1

Filestash skips TLS certificate verification process when sending out email verification codes

Vendor

GitHub Security Advisories

Published

July 31, 2024

Last Modified

August 7, 2024

🔗 CVE IDs covered (1)

CVE-2024-41256 →

📋 Description

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.

🎯 Affected products1

go/github.com/mickael-kerjean/filestash:<= 0.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-41256
https://gist.github.com/nyxfqq/a6da3fe6128b978ea1aaa5df639d5f98
https://github.com/mickael-kerjean/filestash/issues/709
https://github.com/mickael-kerjean/filestash/blob/master/server/model/share.go#L132
https://pkg.go.dev/vuln/GO-2024-3035
https://github.com/advisories/GHSA-mpvx-whpp-99xj