CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2024-41256
Medium (5.9) in filestash filestash. EPSS 0.2% chance of exploitation in the next 30 days.
Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- filestash:filestash
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mpvx-whpp-99xj | Go | github.com/mickael-kerjean/filestash | <=0.4 | no fix published |
| GO-2024-3035 | Go | github.com/mickael-kerjean/filestash | all versions | no fix published |