AIKIDO-2024-10501
github.com/mailgun/mailgun-go/v4 is vulnerable to Incorrect Use of Privileged APIs
18
Low Risk
This Affects:
github.com/mailgun/mailgun-go/v4TL;DR
Affected versions of this package incorrectly use the APIKey as the signature key in the VerifyWebhookSignature method instead of the intended WebhookSigningKey. This misconfiguration weakens the security of webhook verification, potentially allowing attackers to bypass signature checks and send unauthorized requests.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/mailgun/mailgun-go/v4 is vulnerable to Incorrect Use of Privileged APIs in versions 4.0.0 - 4.18.5.
How to fix this
Upgrade the github.com/mailgun/mailgun-go/v4 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant