Vulnerability in Drakkan Sftpgo

CVE-2024-52801

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby g…

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.004 (31.5th percentile) — read the EPSS interpretation.

Affected products

Drakkan Sftpgo — versions >= 2.3.0, < 2.6.4

Weakness classification (CWE)

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)