CVE-2024-55196: GoPhish sends cleartext passwords

December 19, 2024 (updated January 2, 2025)

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.

References

github.com/advisories/GHSA-rv83-h68q-c4wq
github.com/gophish/gophish
github.com/hexkaster/SecurityResearch/blob/main/CVE-2024-55196.md
nvd.nist.gov/vuln/detail/CVE-2024-55196

Detect and mitigate CVE-2024-55196 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →