CVE-2024-41253 - goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component

Back Back to CVE browser

HIGH

goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component

Published Jul 31, 2024

7.1

HIGH

CVSS 3.1

EPSS 0.12%

Description

goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.

Affected products

Vendor Goframe Product Goframe Default
n/a
- Version
  2.7.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Goframe

n/a

Version	Status	Constraints
2.7.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-599

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38990		Advisory
https://gist.github.com/nyxfqq/f69d41c69a4d0751841f4d972b9745da

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 31, 2024

Updated Jul 31, 2024

Reserved Jul 18, 2024

Link CVE-2024-41253

CISA Vulnrichment

Updated Jul 31, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2024-41253

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-41253

ENISA EUVD

Assigner mitre

Published Jul 31, 2024

Updated Jul 31, 2024

Exploited since n/a

Link EUVD-2024-38990

EUVD-2024-38990