GHSA-rv83-h68q-c4wq

Source

https://github.com/advisories/GHSA-rv83-h68q-c4wq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-rv83-h68q-c4wq/GHSA-rv83-h68q-c4wq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rv83-h68q-c4wq

Aliases

CVE-2024-55196
GO-2025-3361

Published

2024-12-19T21:31:10Z

Modified

2025-01-07T16:27:05.611752Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

GoPhish sends cleartext passwords

Details

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.

Database specific

{
    "nvd_published_at": "2024-12-19T19:15:07Z",
    "cwe_ids": [
        "CWE-312"
    ],
    "github_reviewed_at": "2025-01-02T21:52:39Z",
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/gophish/gophish

Package

Name: github.com/gophish/gophish; View open source insights on deps.dev
Purl: pkg:golang/github.com/gophish/gophish

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.12.1