Title: SFTPGO 2.6.2
Description: En SFTPGO 2.6.2, la implementación de JWT carece de ciertas medidas de seguridad, como el uso de reclamos de JWT ID (JTI), nonces y mecanismos adecuados de caducidad e invalidación.

MITRE disputed

In SFTPGO 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms. NOTE: The vendor argues that the prerequisite for this exploit is to be able to steal another user's cookie. Additionally, it is argued that SFTPGo validates cookies being used by the IP address it was issued to, so stolen cookies from different IP addresses will not work.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CISA-ADP AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NIST AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA-ADP CWE-639

NIST CWE-639

OR
     
          *cpe:2.3:a:sftpgo_project:sftpgo:2.6.2:*:*:*:*:*:*:*

MITRE https://alexsecurity.rocks/posts/cve-2024-40430/

MITRE https://github.com/github/advisory-database/pull/4645

CISA-ADP AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA-ADP CWE-639

MITRE disputed

In SFTPGO 2.6.2, the JWT implementation lacks cerrtain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.

In SFTPGO 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms. NOTE: The vendor argues that the prerequisite for this exploit is to be able to steal another user's cookie. Additionally, it is argued that SFTPGo validates cookies being used by the IP address it was issued to, so stolen cookies from different IP addresses will not work.

MITRE https://github.com/github/advisory-database/pull/4645 [No types assigned]

NIST AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

NIST CWE-639

OR
     *cpe:2.3:a:sftpgo_project:sftpgo:2.6.2:*:*:*:*:*:*:*

https://alexsecurity.rocks/posts/cve-2024-40430/ No Types Assigned

https://alexsecurity.rocks/posts/cve-2024-40430/ Exploit, Third Party Advisory

In SFTPGO 2.6.2, the JWT implementation lacks cerrtain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.

MITRE https://alexsecurity.rocks/posts/cve-2024-40430/ [No types assigned]