Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ydjgzLWg2OHEtYzR3cc4ABCoq

GoPhish sends cleartext passwords

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.

Permalink: https://github.com/advisories/GHSA-rv83-h68q-c4wq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ydjgzLWg2OHEtYzR3cc4ABCoq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 20 days ago
Updated: 6 days ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.10892

Identifiers: GHSA-rv83-h68q-c4wq, CVE-2024-55196
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-55196
• https://github.com/hexkaster/SecurityResearch/blob/main/CVE-2024-55196.md
• https://github.com/advisories/GHSA-rv83-h68q-c4wq

Repository: https://github.com/hexkaster/SecurityResearch
Blast Radius: 9.0

Affected Packages