Title: SFTPGO 2.6.2
Description: En SFTPGO 2.6.2, la implementación de JWT carece de ciertas medidas de seguridad, como el uso de reclamos de JWT ID (JTI), nonces y mecanismos adecuados de caducidad e invalidación.

OR
     
          *cpe:2.3:a:sftpgo_project:sftpgo:2.6.2:*:*:*:*:*:*:*

CISA-ADP AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NIST AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA-ADP CWE-639

NIST CWE-639

In SFTPGO 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms. NOTE: The vendor argues that the prerequisite for this exploit is to be able to steal another user's cookie. Additionally, it is argued that SFTPGo validates cookies being used by the IP address it was issued to, so stolen cookies from different IP addresses will not work.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

MITRE https://alexsecurity.rocks/posts/cve-2024-40430/

MITRE https://github.com/github/advisory-database/pull/4645

MITRE disputed

CISA-ADP AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA-ADP CWE-639

In SFTPGO 2.6.2, the JWT implementation lacks cerrtain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.

In SFTPGO 2.6.2, the JWT implementation lacks certain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms. NOTE: The vendor argues that the prerequisite for this exploit is to be able to steal another user's cookie. Additionally, it is argued that SFTPGo validates cookies being used by the IP address it was issued to, so stolen cookies from different IP addresses will not work.

MITRE https://github.com/github/advisory-database/pull/4645 [No types assigned]

MITRE disputed

OR
     *cpe:2.3:a:sftpgo_project:sftpgo:2.6.2:*:*:*:*:*:*:*

NIST AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

NIST CWE-639

https://alexsecurity.rocks/posts/cve-2024-40430/ No Types Assigned

https://alexsecurity.rocks/posts/cve-2024-40430/ Exploit, Third Party Advisory

In SFTPGO 2.6.2, the JWT implementation lacks cerrtain security measures, such as using JWT ID (JTI) claims, nonces, and proper expiration and invalidation mechanisms.

MITRE https://alexsecurity.rocks/posts/cve-2024-40430/ [No types assigned]