Vulnerability · Published Dec 19, 2024 · Assigned by mitre
CVE-2024-55196
High 7.5
In plain English
A high-severity security flaw in the github.com/gophish/gophish package (Go). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gophish/gophish | no fix listed | GHSA-rv83-h68q-c4wq |
| Go | github.com/gophish/gophish | no fix listed | GO-2025-3361 |
Affected products (as reported)
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N