x/vulndb: potential Go vuln in github.com/drakkan/sftpgo: CVE-2024-37897

[GoVulnBot]

Advisory CVE-2024-37897 references a vulnerability in the following Go modules:

Module
github.com/drakkan/sftpgo

Description:
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV
server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient
support password reset. This feature is disabled in the default configuration.
In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with
access restrictions (e.g. expired) can reset their password and log in. Users
are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the
password reset feature disabled or set a blank email address for users and
admins with access restrictions so they cannot receiv...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-37897
• FIX: drakkan/sftpgo@1f8ac8b
• WEB: GHSA-hw5f-6wvv-xcrh

Cross references:

• Module github.com/drakkan/sftpgo appears in issue x/vulndb: potential Go vuln in github.com/drakkan/sftpgo: CVE-2022-36071 #964 NOT_IMPORTABLE
• Module github.com/drakkan/sftpgo appears in issue x/vulndb: potential Go vuln in github.com/drakkan/sftpgo: CVE-2022-39220 #1015 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/drakkan/sftpgo
      vulnerable_at: 1.2.2
      packages:
        - package: sftpgo
summary: CVE-2024-37897 in github.com/drakkan/sftpgo
cves:
    - CVE-2024-37897
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-37897
    - fix: https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423
    - web: https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh
source:
    id: CVE-2024-37897
    created: 2024-06-20T19:01:16.029278447Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/594901 mentions this issue: data/reports: add 18 unreviewed reports

[tatianab]

Duplicate of #2940