MEDIUM🇵🇱 Wersja polska

CVE-2024-41256

CVSS 5.9v3.1pub. 2024-07-31upd. 2025-03-18

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Filestash

    APP
    Filestash
    ≤ 0.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-41255HIGH7.5same product

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allow...

CVE-2024-41258MEDIUM5.3same product

An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key veri...