From da13e2bdeab21e617c284e61070ae41e052ac5b1 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 31 Jul 2024 18:44:21 +0000
Subject: [PATCH] Publish GHSA-x72p-g37q-4xr9

---
 .../07/GHSA-x72p-g37q-4xr9/GHSA-x72p-g37q-4xr9.json   | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/advisories/github-reviewed/2024/07/GHSA-x72p-g37q-4xr9/GHSA-x72p-g37q-4xr9.json b/advisories/github-reviewed/2024/07/GHSA-x72p-g37q-4xr9/GHSA-x72p-g37q-4xr9.json
index 64f8dc128a8..557103c3f41 100644
--- a/advisories/github-reviewed/2024/07/GHSA-x72p-g37q-4xr9/GHSA-x72p-g37q-4xr9.json
+++ b/advisories/github-reviewed/2024/07/GHSA-x72p-g37q-4xr9/GHSA-x72p-g37q-4xr9.json
@@ -1,13 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x72p-g37q-4xr9",
-  "modified": "2024-07-26T21:37:16Z",
+  "modified": "2024-07-31T18:42:56Z",
   "published": "2024-07-22T09:31:55Z",
+  "withdrawn": "2024-07-31T18:42:56Z",
   "aliases": [
     "CVE-2024-40430"
   ],
-  "summary": "SFTPGo's JWT implmentation lacks certain security measures",
-  "details": "In SFTPGo 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.",
+  "summary": "Withdrawn: SFTPGo's JWT implmentation lacks certain security measures",
+  "details": "Withdrawn:\nThe attack vector described in the backing report required that an attacker gain access to a user's session cookie. By gaining access to the session cookie the attacker is for all intents and purposes the valid user and any access to user data would be expected.\n\n~In SFTPGo 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.~",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -44,6 +45,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40430"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/github/advisory-database/pull/4645"
+    },
     {
       "type": "WEB",
       "url": "https://alexsecurity.rocks/posts/cve-2024-40430"