The vulnerability of the Go programming language’s filepath package, which allows attackers to disclose protected information

🗓️ 22 Dec 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Go filepath package vulnerability enables remote disclosure of sensitive information in restricted directories.

Reporter	Title	Published	Views	Family All 461
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in go and opm affect IBM Robotic Process Automation.	16 Jul 202413:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	5 Jun 202420:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Go affect IBM Robotic Process Automation for Cloud Pak	4 Feb 202520:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Golang Go directory transversal vulnerabilitiy.(CVE-2023-45283)	21 Jun 202415:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is susceptible to numerous vulnerabilities due to Golang Go	1 Jul 202405:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to sensitive information leakage and directory traversal attack due to the Golang related packages (CVE-2023-45285, CVE-2023-39326, CVE-2023-45283).	25 Apr 202405:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to directory traversal due to golang compiler ( CVE-2023-45283,CVE-2023-45284, CVE-2023-45285 )	11 Apr 202421:37	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in Go related packages that are shipped with IBM CICS TX Standard.	12 Mar 202412:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana for Self-Hosted Standard Edition is affected by Multiple Security Vulnerabilities	17 Oct 202408:51	–	ibm

Vulners

Node

novell suse_manager_retail_branch_serverMatch4.3

novell suse_manager_proxyMatch4.3

novell suse_manager_serverMatch4.3

go goRange<1.20.11

go goRange1.21.0–1.21.4

linux helmMatch3.13.2

novell opensuse_leapMatch15.5

novell opensuse_leapMatch15.4

Source	Link
go	www.go.dev/cl/540277
go	www.go.dev/issue/63713
pkg	www.pkg.go.dev/vuln/GO-2023-2185
groups	www.groups.google.com/g/golang-announce/c/4tU8LZfBFkY
security	www.security.netapp.com/advisory/ntap-20231214-0008/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-45283
suse	www.suse.com/security/cve/CVE-2023-45283.html
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

02 Sep 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 37.5

CVSS 27.8

EPSS0.02758