Description

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.

Related CPE's

a

filestash

filestash

Vulnerable

References

https://gist.github.com/nyxfqq/a6da3fe6128b978ea1aaa5df639d5f98

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-295

CVSS impact metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.9 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-07-31T21:15:18.117

3 months ago

Last modified

2024-08-15T14:27:18.487

2 months ago