GHSA-67fw-w8f2-88wp

ghsaUSosv

casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

view advisory published 2024-08-01Licence: CC-BY-4.0

An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the `ssh.InsecureIgnoreHostKey()` method.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-41264US	high7.5	0.46% (40th)	—	2024-08-01
An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.