CVE-2024-55196
GoPhish sends cleartext passwords
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- Record
CVE-2024-55196- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
EUVDEUVD-2024-3612
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- Record
EUVD-2024-3612- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rv83-h68q-c4wq
GoPhish sends cleartext passwords
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- Record
GHSA-rv83-h68q-c4wq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
NVD
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- Record
CVE-2024-55196- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSVGHSA-rv83-h68q-c4wq
GoPhish sends cleartext passwords
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- Record
GHSA-rv83-h68q-c4wq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSVGO-2025-3361 No score
GoPhish sends cleartext passwords in github.com/gophish/gophish
GoPhish sends cleartext passwords in github.com/gophish/gophish
- Record
GO-2025-3361- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14624-1 No score
govulncheck-vulndb-0.0.20250108T191942-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250108T191942-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14624-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0060-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
-
Update to version 0.0.20250108T191942 2025-01-08T19:19:42Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3371 GHSA-2r2v-9pf8-6342
- GO-2025-3374 CVE-2025-22130 GHSA-j4jw-m6xr-fv6c
-
Update to version 0.0.20250107T160406 2025-01-07T16:04:06Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3363 GO-2025-3364 GO-2025-3367 GO-2025-3368
- GO-2024-3355 CVE-2024-54148 GHSA-r7j8-5h9c-f6fx
- GO-2024-3356 CVE-2024-55947 GHSA-qf5v-rp47-55gg
- GO-2024-3357 CVE-2024-56362 GHSA-xwx7-p63r-2rj8
- GO-2024-3358 CVE-2024-45387 GHSA-vq94-9pfv-ccqr
- GO-2024-3359 CVE-2024-28892 GHSA-5qww-56gc-f66c
- GO-2024-3360 CVE-2024-25133 GHSA-wgqq-9qh8-wvqv
- GO-2025-3361 CVE-2024-55196 GHSA-rv83-h68q-c4wq
- GO-2025-3362 CVE-2025-21609 GHSA-8fx8-pffw-w498
- GO-2025-3363 CVE-2024-56514 GHSA-cwrh-575j-8vr3
- GO-2025-3364 CVE-2024-56513 GHSA-mg7w-c9x2-xh7r
- GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4
- GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m
-
Update to version 0.0.20241220T214820 2024-12-20T21:48:20Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2024-3101 GHSA-75qh-gg76-p2w4
- GO-2024-3339 GHSA-8wcc-m6j2-qxvm
-
Update to version 0.0.20241220T203729 2024-12-20T20:37:29Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2024-3101 GHSA-75qh-gg76-p2w4
- GO-2024-3109 CVE-2024-43803 GHSA-pqfh-xh7w-7h3p
- GO-2024-3333 CVE-2024-45338 GHSA-w32m-9786-jp63
- GO-2024-3342 GHSA-hxr6-2p24-hf98
- GO-2024-3343 CVE-2024-9779 GHSA-jhh6-6fhp-q2xp
- GO-2024-3344 GHSA-32gq-x56h-299c
- GO-2024-3349 CVE-2024-25131 GHSA-77c2-c35q-254w
- GO-2024-3350 GHSA-5pf6-cq2v-23ww
- GO-2024-3354 CVE-2024-12678 GHSA-hr68-hvgv-xxqf
- Record
SUSE-SU-2025:0060-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/gophish/gophishGo |
through 0.12.1 | None known |
github.com/gophish/gophishGo |
All versions | None known |
govulncheck-vulndbSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 18 CVEs |
before 0.0.20250108T191942-150000.1.26.1 | 0.0.20250108T191942-150000.1.26.1 |
govulncheck-vulndbopenSUSE:Leap 15.6 From an advisory covering 18 CVEs |
before 0.0.20250108T191942-150000.1.26.1 | 0.0.20250108T191942-150000.1.26.1 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 13 CVEs |
before 0.0.20250108T191942-1.1 | 0.0.20250108T191942-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-55196 is a high vulnerability (CVSS 7.5) in github.com/gophish/gophish, published December 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. No source names a fixed version.
References
github.com/hexkaster/SecurityResearch/blob/main/CVE-2024-55196.md
nvd.nist.gov/vuln/detail/CVE-2024-55196
suse.com/support/update/announcement/2025/suse-su-20250060-1
Show 18 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/UV63VQGB6Y3V7AIZHIKF3PMFVIHM32MI