CVE-2024-55196 GoPhish sends cleartext passwords
Attackers can access cleartext IMAP and SMTP passwords from GoPhish configuration, exposing email server credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-55196?
CVE-2024-55196 is a high-severity vulnerability in n/a, published on 19 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
Weakness: CWE-312
Which versions are affected by CVE-2024-55196?
3 open source packages ship an affected version, including github.com/gophish/gophish.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gophish/gophish Go | All versions | None |
github.com/gophish/gophish Go | All versions to 0.12.1 | None |
github.com/gophish/gophish Go | All versions to 0.12.1 | None |
How do I fix CVE-2024-55196?
Upgrade to a fixed version.
Is CVE-2024-55196 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55196 exists.
Sources
Also known as GHSA-rv83-h68q-c4wq, GO-2025-3361.