Paper/Archive/CVE-2024-41270

CVE-2024-41270

appleboy gorush — An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of depre…

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 23.7.237 × 204.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

gorush≤ 1.18.4–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc