CVE-2024-37897

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Users are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the password reset feature disabled or set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-378984.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit r CVE-2024-378998.0XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user accou CVE-2024-37904.8Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemUsers, login / description CVE-2024-379004.6XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a CVE-2024-379018.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any pag CVE-2024-3790210.0DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path a CVE-2024-379038.2Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting CVE-2024-379045.7Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciou CVE-2024-379058.8authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be explo CVE-2024-379068.8Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an CVE-2024-37914.8Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemConfiguration, name / free CVE-2024-379177.5Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a