Lucene search

MitreCVE-2024-41258

HistoryJul 31, 2024 - 9:15 p.m.

CVE-2024-41258

2024-07-3121:15:18

CWE-347

mitre

web.nvd.nist.gov

filestash v0.4

man-in-the-middle attack

host key verification

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

37.7%

JSON

An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.

Affected configurations

Nvd

Node

filestashfilestashRange≤0.4

VendorProductVersionCPE
filestashfilestash*cpe:2.3:a:filestash:filestash:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
filestash	filestash	*	cpe:2.3:a:filestash:filestash::::::::

References

gist.github.com/nyxfqq/ed8c2ba3398c9e28cd8dbf0902bd8edf

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

37.7%

JSON

Related for CVE-2024-41258