CVE-2024-41264 - An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method

MEDIUM

An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method

Published Aug 1, 2024

6.9

MEDIUM

CVSS 4.0

EPSS 0.46%

An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Casbin	Casdoor	unknown	Affected 1.636.0

Ecosystem	Package	Introduced	Fixed
Go	github.com/casdoor/casdoor	1.541.0	not fixed

No remediation recorded yet.

Weaknesses (3)

CWE-200

Exposure of Sensitive Information

CWE-295

Improper Certificate Validation

CWE-297

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2511		Advisory
https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f		Third Party Advisory
https://github.com/advisories/GHSA-67fw-w8f2-88wp		Advisory
https://github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go
https://nvd.nist.gov/vuln/detail/CVE-2024-41264
https://pkg.go.dev/vuln/GO-2024-3026