CVE-2024-52801CWE-327

Brute force takeover of OpenID Connect session cookies in sftpgo

Medium · published November 29, 2024

CVSS v4.0
5.3
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00405 · 33.6th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2024-11-29T18:26Z
EPSS history
Timeline
  • 29 NOV 18:26Z
    Brute force takeover of OpenID Connect session cookies in sftpgo
    cvelistv5