{"id":"CVE-2022-36071","aliases":["EUVD-2022-6703","GHSA-54qx-8p8w-xhg8","GO-2022-0964"],"status":"published","title":"Recovery codes abuse in SFTPGo","description":"SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00547,"percentile":0.46112,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-916"],"published":"2022-09-02T17:15:12Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Go","package":"github.com/drakkan/sftpgo/v2","fixed_in":["2.3.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/drakkan/sftpgo/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.3.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/drakkan/sftpgo/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.3.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/drakkan/sftpgo","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/drakkan/sftpgo/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.3.4"}]}]}],"products":[{"vendor":"drakkan","product":"sftpgo"},{"vendor":"sftpgo_project","product":"sftpgo"}],"references":[{"url":"https://github.com/drakkan/sftpgo/security/advisories/GHSA-54qx-8p8w-xhg8","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://github.com/drakkan/sftpgo/issues/965","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36071","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-54qx-8p8w-xhg8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36071.json","tags":["advisory"]},{"url":"https://github.com/drakkan/sftpgo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-36071","title":"Recovery codes abuse in SFTPGo","description":"SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.","status":"published","published":"2022-09-02T17:15:12Z","modified":"2025-04-22T17:24:43.553Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-6703","description":"SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.","status":"published","published":"2022-09-02T17:15:12Z","modified":"2025-04-22T17:24:43Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:16.055056Z"}],"ghsa":[{"id":"GHSA-54qx-8p8w-xhg8","title":"SFTPGo vulnerable to recovery codes abuse","description":"### Impact\n\nSFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a seconday authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP.\n\nIn SFTPGo versions from v2.2.0 to v2.3.3 recovery codes can be generated before enabling two-factor authentication.\nAn attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time.\n\n### Patches\n\nFixed in v2.3.4.\nRecovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.\n\n### Workarounds\n\nRegenerate recovery codes after enabling two-factor authentication.\n\n### References\n\nhttps://github.com/drakkan/sftpgo/issues/965\n","status":"published","published":"2022-09-16T21:05:28Z","modified":"2023-01-27T05:03:11Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-287","CWE-916"],"updated_at":"2026-11-02T14:36:20.144464Z"}],"nvd":[{"id":"CVE-2022-36071","description":"SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.","status":"published","published":"2022-09-02T18:15:12.15Z","modified":"2026-06-17T04:52:51.387Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-287","CWE-916"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"CVE-2022-36071","title":"Recovery codes abuse in SFTPGo","description":"SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.","status":"published","published":"2022-09-02T17:15:12Z","modified":"2026-10-28T02:30:36.295945464Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-54qx-8p8w-xhg8","title":"SFTPGo vulnerable to recovery codes abuse","description":"### Impact\n\nSFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a seconday authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP.\n\nIn SFTPGo versions from v2.2.0 to v2.3.3 recovery codes can be generated before enabling two-factor authentication.\nAn attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time.\n\n### Patches\n\nFixed in v2.3.4.\nRecovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.\n\n### Workarounds\n\nRegenerate recovery codes after enabling two-factor authentication.\n\n### References\n\nhttps://github.com/drakkan/sftpgo/issues/965\n","status":"published","published":"2022-09-16T21:05:28Z","modified":"2024-08-21T16:28:54.483117Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-287","CWE-916"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"GO-2022-0964","title":"SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo","description":"SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo","status":"published","published":"2024-08-21T16:03:21Z","modified":"2026-03-03T04:52:33.164973Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}