← Vulnerability feed

Vulnerability record · CVE-2024-55885 · published 12 December 2024

CVE-2024-55885: Beego broken cryptographic algorithm vulnerability

Beego · Beego

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.

6.9 CVSS 4.0 Medium EPSS 0.35% · top 74.3% CWE-327 · Broken cryptographic algorithmCWE-328 · CWE-328
6.9CVSS 4.0 base score
0.35%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/beego/beego/commit/e7fa4835f71f47ab1d13afd638cebf661800d5a4 Patch
https://github.com/beego/beego/security/advisories/GHSA-9j3m-fr7q-jxfw MitigationVendor Advisory

Track CVE-2024-55885 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-31836Beego path traversal vulnerabilityThe leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.EPSS 1.7%9.8CVE-2022-31259Beego vulnerabilityThe route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configur…EPSS 22%9.8CVE-2021-30080Beego vulnerabilityAn issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.EPSS 1.3%9.6CVE-2025-30223Beego cross-site scripting vulnerabilityBeego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's R…EPSS 0.59%8.8CVE-2024-40464Beego improper certificate validation vulnerabilityAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go fileEPSS 0.57%8.8CVE-2024-40465Beego broken cryptographic algorithm vulnerabilityAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileEPSS 0.43%7.8CVE-2021-27116Beego link following vulnerabilityAn issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.EPSS 0.44%7.8CVE-2021-27117Beego link following vulnerabilityAn issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2024-55885), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.