netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-x72p-g37q-4xr9

Browse Source
This commit is contained in:
advisory-database[bot]
2024-07-31 18:44:21 +00:00
parent 45e81ed5db
commit da13e2bdea
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/07/GHSA-x72p-g37q-4xr9/GHSA-x72p-g37q-4xr9.json
+8 -3
View File
@@ -1,13 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x72p-g37q-4xr9",
"modified": "2024-07-26T21:37:16Z",
"modified": "2024-07-31T18:42:56Z",
"published": "2024-07-22T09:31:55Z",
"withdrawn": "2024-07-31T18:42:56Z",
"aliases": [
"CVE-2024-40430"
],
"summary": "SFTPGo's JWT implmentation lacks certain security measures",
"details": "In SFTPGo 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.",
"summary": "Withdrawn: SFTPGo's JWT implmentation lacks certain security measures",
"details": "Withdrawn:\nThe attack vector described in the backing report required that an attacker gain access to a user's session cookie. By gaining access to the session cookie the attacker is for all intents and purposes the valid user and any access to user data would be expected.\n\n~In SFTPGo 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.~",
"severity": [
{
"type": "CVSS_V3",
@@ -44,6 +45,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40430"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/4645"
},
{
"type": "WEB",
"url": "https://alexsecurity.rocks/posts/cve-2024-40430"