CVE-2022-36071

CVE-2022-36071 is a high-severity authentication bypass vulnerability affecting SFTPGo versions 2.2.0 through 2.3.3. It allows an authenticated attacker, knowing a user's password, to generate two-factor authentication (2FA) recovery codes before 2FA is enabled. This pre-generated code can then be used to bypass 2FA once it is activated on the account. The vulnerability has a CVSS score of 8.1 (High), indicating a low attack complexity and no user interaction required, leading to high confidentiality and integrity impacts. The attacker only needs low privileges (a valid user's password) to exploit this. Currently, there is no evidence of active exploitation, nor are there any public exploit modules available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness. The issue has been patched in SFTPGo version 2.3.4.