CVE-2024-29887highCWE-295

CVE-2024-29887: falha de alta gravidade em serverpod

Serverpod client accepts any certificate

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar serverpod+ Monitorar serverpod_client

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.3%
Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
serverpod · serverpod
CVEs relacionadas — serverpod

No mesmo produto, das mais perigosas para as menos.

CVE-2024-29886MEDIUMImproved security for stored password hashesEPSS 0.3%