CVE-2024-29887
High
Description
Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.
SeverityHigh
CVSS7.4
Exploit probability—
ProductServerpod
PublishedMar 27, 2024
First seenMar 27, 2024
Weakness typeCWE-295CWE-295
How to fix
Update
- serverpod serverpod1.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| serverpod serverpod | v < 1.2.6 | 1.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.