CVE-2024-40464 - An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file

Back Back to CVE browser

HIGH

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file

Published Jul 31, 2024

8.7

HIGH

CVSS 4.0

EPSS 0.57%

Description

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file

Affected products

Vendor Beego Product Beego Default
unknown
Affected
- ≥ 0, ≤ 2.2.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Beego	Beego	unknown	Affected ≥ 0, ≤ 2.2.0

Ecosystem	Package	Introduced	Fixed
Go	github.com/beego/beego/v2	0	2.2.1

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-295

Improper Certificate Validation

CWE-599

References (6)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2410		Advisory
https://gist.github.com/nyxfqq/b53b0148b9aa040de63f58a68fd11445		Third Party Advisory
https://github.com/advisories/GHSA-r6qh-j42j-pw64		Advisory
https://github.com/beego/beego/commit/8f89e12e6cafb106d5c201dbc3b2a338bfde74e2
https://github.com/beego/beego/security/advisories/GHSA-6g9p-wv47-4fxq
https://nvd.nist.gov/vuln/detail/CVE-2024-40464