Lucene search
HistoryJul 31, 2024 - 9:15 p.m.
CVE-2024-41258
filestash v0.4
ssh
insecureignorehostkey
vulnerability
man-in-the-middle attack
host key verification
sensitive information
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
37.7%
An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.
Affected configurations
Node
filestashfilestashRange≤0.4
Related
vulnrichment
vulnrichment
CVE-2024-41258
2024-07-31 00:00:00
cvelist
cvelist
CVE-2024-41258
2024-07-31 00:00:00
cve
cve
CVE-2024-41258
2024-07-31 21:15:18
veracode
veracode
Man-In-The-Middle Attack
2024-08-02 04:24:33
osv
osv
CVE-2024-41258
2024-07-31 21:15:18
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS
0.001
Percentile
37.7%
Related for NVD:CVE-2024-41258