{"cve":"CVE-2024-37897","nvd":{"published":"2024-06-20T18:15:13.023","modified":"2026-06-17T07:39:00.540","status":"Deferred","description":"SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration.\nIn SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Users are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the password reset feature disabled or set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-287"],"references":["https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423","https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh","https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423","https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:52:00.836172422+00:00"},"epss":{"cve":"CVE-2024-37897","score":0.0031,"percentile":0.2386,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hw5f-6wvv-xcrh","url":"https://osv.dev/vulnerability/GHSA-hw5f-6wvv-xcrh","summary":"SFTPGo has insufficient access control for password reset","modified":"2026-09-10T03:50:15.638617984Z","packages":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","purl":"pkg:golang/github.com/drakkan/sftpgo/v2","ranges":[">=2.2.0 <2.6.1"],"fixed":["2.6.1"]}]},{"id":"GO-2024-2940","url":"https://osv.dev/vulnerability/GO-2024-2940","summary":"SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo","modified":"2026-03-03T04:55:30.841579Z","packages":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo","purl":"pkg:golang/github.com/drakkan/sftpgo","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","purl":"pkg:golang/github.com/drakkan/sftpgo/v2","ranges":[">=2.2.0 <2.6.1"],"fixed":["2.6.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}