CVE-2022-36071 Recovery codes abuse in SFTPGo

SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP Time-based One Time Passwords as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged,...

PT-2022-23159 · Sftpgo · Sftpgo

Name of the Vulnerable Software and Affected Versions: SFTPGo versions 2.2.0 through 2.3.3 Description: SFTPGo is a configurable SFTP server with optional HTTP/S, FTP/S, and WebDAV support. It supports login using TOTP Time-based One Time Passwords as a secondary authentication factor and also...

SFTPGo 授权问题漏洞

SFTPGo is a full-featured and highly configurable SFTP server by Nicola Murino, a personal developer in Italy. An authorization issue vulnerability exists in SFTPGo versions 2.2.0 through 2.3.3, which stems from the fact that TOTP is typically configured on mobile devices that may be lost, stolen...