« Volver al listado

CVE-2024-37897

Estado: AplazadaMedia (5.4)—

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Users are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the password reset feature disabled or set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sftpgo — SftpgoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-37897",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37897",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-27T13:14:38.624575Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "drakkan",
          "product": "sftpgo",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.2.0, < 2.6.1"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sftpgo_project:sftpgo:2.2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "sftpgo_project",
          "product": "sftpgo",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0",
              "lessThan": "2.6.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-20T18:15:13.023",
  "references": [
    {
      "url": "https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration.\nIn SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Users are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the password reset feature disabled or set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability."
    },
    {
      "lang": "es",
      "value": "SFTPGo es un servidor SFTP, HTTP/S, FTP/S y WebDAV con todas las funciones y altamente configurable: S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin y WebClient admiten el restablecimiento de contraseña. Esta característica está deshabilitada en la configuración predeterminada. En las versiones de SFTPGo anteriores a la v2.6.1, si la función está habilitada, incluso los usuarios con restricciones de acceso (por ejemplo, vencidas) pueden restablecer su contraseña e iniciar sesión. Se recomienda a los usuarios que actualicen a la versión 2.6.1. Los usuarios que no puedan actualizar pueden mantener la función de restablecimiento de contraseña desactivada o establecer una dirección de correo electrónico en blanco para los usuarios y administradores con restricciones de acceso para que no puedan recibir el correo electrónico con el código de restablecimiento y explotar la vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:39:00.540",
  "sourceIdentifier": "security-advisories@github.com"
}