{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29887", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-21T15:12:08.997Z", "datePublished": "2024-03-27T18:46:32.750Z", "dateUpdated": "2024-08-27T20:30:09.237Z"}, "containers": {"cna": {"title": "Serverpod client accepts any certificate", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw"}, {"name": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71", "tags": ["x_refsource_MISC"], "url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71"}], "affected": [{"vendor": "serverpod", "product": "serverpod", "versions": [{"version": "< 1.2.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-27T18:46:32.750Z"}, "descriptions": [{"lang": "en", "value": "Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.\n\n"}], "source": {"advisory": "GHSA-h6x7-r5rg-x5fw", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.177Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw"}, {"name": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71"}]}, {"affected": [{"vendor": "serverpod", "product": "serverpod", "cpes": ["cpe:2.3:a:serverpod:serverpod:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.2.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-28T18:21:32.573935Z", "id": "CVE-2024-29887", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T20:30:09.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw", "name": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71", "name": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.177Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29887", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-28T18:21:32.573935Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:serverpod:serverpod:*:*:*:*:*:*:*:*"], "vendor": "serverpod", "product": "serverpod", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.6", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T20:30:05.054Z"}}], "cna": {"title": "Serverpod client accepts any certificate", "source": {"advisory": "GHSA-h6x7-r5rg-x5fw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "serverpod", "product": "serverpod", "versions": [{"status": "affected", "version": "< 1.2.6"}]}], "references": [{"url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw", "name": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71", "name": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.\n\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-27T18:46:32.750Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29887", "state": "PUBLISHED", "dateUpdated": "2024-08-27T20:30:09.237Z", "dateReserved": "2024-03-21T15:12:08.997Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-27T18:46:32.750Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.\n\n"}, {"lang": "es", "value": "Serverpod es una aplicaci\u00f3n y un servidor web, creado para el ecosistema Flutter y Dart. Este error omiti\u00f3 la validaci\u00f3n de los certificados TSL en todos los clientes HTTP que no son web en el paquete `serverpod_client`. Haci\u00e9ndolos susceptibles a un ataque de intermediario contra el tr\u00e1fico cifrado entre el dispositivo cliente y el servidor. Un atacante tendr\u00eda que poder interceptar el tr\u00e1fico y secuestrar la conexi\u00f3n al servidor para poder utilizar esta vulnerabilidad. La actualizaci\u00f3n a la versi\u00f3n `1.2.6` resuelve este problema."}], "id": "CVE-2024-29887", "lastModified": "2024-11-21T09:08:33.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-03-27T19:15:49.230", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71"}, {"source": "security-advisories@github.com", "url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-13T21:07:55.230219+00:00", "updated": "2025-07-13T21:07:55.230273+00:00", "vendors": ["serverpod", "serverpod$PRODUCT$serverpod"]}