x/vulndb: potential Go vuln in github.com/drakkan/sftpgo/v2: GHSA-hw5f-6wvv-xcrh

[GoVulnBot]

Advisory GHSA-hw5f-6wvv-xcrh references a vulnerability in the following Go modules:

Module
github.com/drakkan/sftpgo/v2

Description:

Impact

SFTPGo WebAdmin and WebClient support password reset. This feature is disabled
in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature
is enabled, even users with access restrictions (e.g. expired) can reset their
password and log in.

Patches

Fixed in v2.6.1.

Workarounds

The following workarounds are available:

• keep the password reset feature disabled.
• Set a blank email address for users and admins with access restrictions so
  they cannot receive the email with the reset code and exploit the vulnerability.

References:

• ADVISORY: GHSA-hw5f-6wvv-xcrh
• ADVISORY: GHSA-hw5f-6wvv-xcrh
• FIX: drakkan/sftpgo@3462bba
• WEB: https://github.com/drakkan/sftpgo/releases/tag/v2.6.1

Cross references:
No existing reports found with this module or alias.
See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/drakkan/sftpgo/v2
      versions:
        - introduced: 2.2.0
          fixed: 2.6.1
      vulnerable_at: 2.6.0
      packages:
        - package: github.com/drakkan/sftpgo/v2
summary: SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo/v2
cves:
    - CVE-2024-37897
ghsas:
    - GHSA-hw5f-6wvv-xcrh
references:
    - advisory: https://github.com/advisories/GHSA-hw5f-6wvv-xcrh
    - advisory: https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh
    - fix: https://github.com/drakkan/sftpgo/commit/3462bba3f41cbc75486474991b9e3ac1b5f1e583
    - web: https://github.com/drakkan/sftpgo/releases/tag/v2.6.1
source:
    id: GHSA-hw5f-6wvv-xcrh
    created: 2024-06-20T17:01:18.890922707Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/594901 mentions this issue: data/reports: add 18 unreviewed reports

[gopherbot]

Change https://go.dev/cl/595636 mentions this issue: data/reports: add 15 unreviewed reports