CVE-2024-40464

gistfile1.txt

 [Suggested description]
 An issue in beego v.2.2.0 and before allows a remote attacker to
 escalate privileges via the sendMail function located in
 beego/core/logs/smtp.go file
 
 ------------------------------------------
 
 [Vulnerability Type]
 Missing SSL Certificate Validation
 
 ------------------------------------------
 
 [Vendor of Product]
 https://github.com/beego/beego
 
 ------------------------------------------
 
 [Affected Product Code Base]
 beego - <= v2.2.0
 
 ------------------------------------------
 
 [Affected Component]
 github.com/beego/beego/core/logs/smtp.go
 
 ------------------------------------------
 
 [Attack Type]
 Remote
 
 ------------------------------------------
 
 [Impact Escalation of Privileges]
 true
 
 ------------------------------------------
 
 [Impact Information Disclosure]
 true
 
 ------------------------------------------
 
 [Attack Vectors]
 when send a email
 
 ------------------------------------------
 
 [Reference]
 https://github.com/beego/beego/security/advisories/GHSA-6g9p-wv47-4fxq
 
 ------------------------------------------
 
 [Has vendor confirmed or acknowledged the vulnerability?]
 true
 
 ------------------------------------------
 
 [Discoverer]
 YueXi Zhang