CVE-2024-29887highCWE-295

CVE-2024-29887: fallo de gravedad alta en serverpod

Serverpod client accepts any certificate

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear serverpod+ Monitorear serverpod_client

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.3%
Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
serverpod · serverpod
CVEs relacionadas — serverpod

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-29886MEDIUMImproved security for stored password hashesEPSS 0.3%