CVE-2024-40464: beego Improper Certificate Validation
Vulnerability summary
CVE-2024-40464 is a high (CVSS 8.8) Improper Certificate Validation vulnerability in beego. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities.
Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 31-07-2024PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.57% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
- CWE-599Missing Validation of OpenSSL CertificateThe product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard10 products
- harbor-2.11< 2.11.2-r20 | < 2.11.1-r4
- harbor-2.11-exporter< 2.11.1-r4
- harbor-2.11-jobservice< 2.11.1-r4
- harbor-2.11-photon-registry< 2.11.1-r4
- harbor-2.11-portal< 2.11.1-r4
Beego1 product
- beego< 2.2.1
Github.com/beego/beego1 product
- v2< 2.2.1
3 vendors · 12 products
References
7 links
- github.com/beego/beegoPACKAGE