search

app-prd / intentionally-vulnerable-golang-project

This is a project we created that has dependencies with vulnerabilities, for us to test out nancy
0 stars 0 forks source link

github.com/gophish/gophish-v0.1.2: 16 vulnerabilities (highest severity is: 7.8) #6

Open mend-for-github-com[bot] opened 7 months ago

mend-for-github-com[bot] commented 7 months ago
Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/gophish/gophish-v0.1.2 version) Remediation Possible**
CVE-2020-24707 High 7.8 github.com/gophish/gophish-v0.1.2 Direct v0.11.0 ✅
CVE-2022-45003 High 7.5 github.com/gophish/gophish-v0.1.2 Direct N/A ❌
CVE-2020-24713 High 7.5 github.com/gophish/gophish-v0.1.2 Direct N/A ❌
CVE-2020-28458 High 7.3 github.com/gophish/gophish-v0.1.2 Direct datatables.net - 1.10.23 ✅
CVE-2020-24711 Medium 6.5 github.com/gophish/gophish-v0.1.2 Direct v0.11.0 ✅
CVE-2022-45004 Medium 6.1 github.com/gophish/gophish-v0.1.2 Direct N/A ❌
CVE-2019-8331 Medium 6.1 github.com/gophish/gophish-v0.1.2 Direct bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1 ✅
CVE-2018-20677 Medium 6.1 github.com/gophish/gophish-v0.1.2 Direct bootstrap - 3.4.0 ✅
CVE-2018-20676 Medium 6.1 github.com/gophish/gophish-v0.1.2 Direct bootstrap - 3.4.0 ✅
CVE-2018-14042 Medium 6.1 github.com/gophish/gophish-v0.1.2 Direct bootstrap - 3.4.0,4.1.2 ✅
CVE-2016-10735 Medium 6.1 github.com/gophish/gophish-v0.1.2 Direct bootstrap - 3.4.0, 4.0.0-beta.2 ✅
CVE-2022-25295 Medium 5.4 github.com/gophish/gophish-v0.1.2 Direct v0.12.0 ✅
CVE-2020-24710 Medium 5.3 github.com/gophish/gophish-v0.1.2 Direct v0.11.0 ✅
CVE-2024-2211 Medium 4.6 github.com/gophish/gophish-v0.1.2 Direct daa3cfd876ebb52a61e99599e5c8fc2e24d39846 ✅
CVE-2018-14040 Low 3.7 github.com/gophish/gophish-v0.1.2 Direct bootstrap - 3.4.0,4.1.2 ✅
CVE-2021-23445 Low 3.1 github.com/gophish/gophish-v0.1.2 Direct datatables.net - 1.11.3 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-24707 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.

Publish Date: 2020-10-28

URL: CVE-2020-24707

### CVSS 3 Score Details (7.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-10-30

Fix Resolution: v0.11.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-45003 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.

Publish Date: 2023-03-22

URL: CVE-2022-45003

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2020-24713 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.

Publish Date: 2020-10-28

URL: CVE-2020-24713

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2020-28458 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

Publish Date: 2020-12-16

URL: CVE-2020-28458

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-12-16

Fix Resolution: datatables.net - 1.10.23

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-24711 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack

Publish Date: 2020-10-28

URL: CVE-2020-24711

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-08-28

Fix Resolution: v0.11.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-45004 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.

Publish Date: 2023-03-22

URL: CVE-2022-45004

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2019-8331 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2018-20677 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2018-20676 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2018-14042 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14042

Release Date: 2018-07-13

Fix Resolution: bootstrap - 3.4.0,4.1.2

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-10735 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. Mend Note: Converted from WS-2018-0021, on 2022-11-08.

Publish Date: 2019-01-09

URL: CVE-2016-10735

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10735

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0, 4.0.0-beta.2

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-25295 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.

Publish Date: 2022-09-11

URL: CVE-2022-25295

### CVSS 3 Score Details (5.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-09-11

Fix Resolution: v0.12.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-24710 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Gophish before 0.11.0 allows SSRF attacks.

Publish Date: 2020-10-28

URL: CVE-2020-24710

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24710

Release Date: 2020-08-28

Fix Resolution: v0.11.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-2211 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.

Publish Date: 2024-03-06

URL: CVE-2024-2211

### CVSS 3 Score Details (4.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2024-03-06

Fix Resolution: daa3cfd876ebb52a61e99599e5c8fc2e24d39846

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2018-14040 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

### CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14040

Release Date: 2018-07-13

Fix Resolution: bootstrap - 3.4.0,4.1.2

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-23445 ### Vulnerable Library - github.com/gophish/gophish-v0.1.2

Open-Source Phishing Toolkit

Library home page: https://proxy.golang.org/github.com/gophish/gophish/@v/v0.1.2.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/gophish/gophish/@v/v0.1.2.mod

Dependency Hierarchy: - :x: **github.com/gophish/gophish-v0.1.2** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

Publish Date: 2021-09-27

URL: CVE-2021-23445

### CVSS 3 Score Details (3.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23445

Release Date: 2021-09-27

Fix Resolution: datatables.net - 1.11.3

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.