Lucene search

Veracode Vulnerability DatabaseVERACODE:48369

HistoryAug 05, 2024 - 6:58 a.m.

Improper Certificate Validation

2024-08-0506:58:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

casdoor

certificate validation

vulnerability

ssh

host key verification

man-in-the-middle

attack

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

37.7%

JSON

github.com/casdoor/casdoor is vulnerable to Improper Certificate Validation. The vulnerability is due to the usage of the ssh.InsecureIgnoreHostKey() method in the file viaSSHDialer.go, which disables host key verification and allows attackers to obtain sensitive information via a man-in-the-middle attack.

References

gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f

github.com/advisories/GHSA-67fw-w8f2-88wp

github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

37.7%

JSON

Related for VERACODE:48369