high7.7
CVE-2024-48460
Eugeny Tabby Sends Password Despite Host Key Verification Failure
Impact
An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | tabby-ssh | < 1.0.214 | 1.0.214 |