Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-91651
HistorySep 30, 2022 - 12:00 a.m.

Hertz path traversal vulnerability

2022-09-3000:00:00
China National Vulnerability Database
www.cnvd.org.cn
10
hertz
path traversal
golang
microservices
http
framework
vulnerability
web requests
resource
file path
attacker
arbitrary files
file system

0.001 Low

EPSS

Percentile

48.8%

Hertz is a Golang microservices HTTP framework open sourced by CloudWeGo. v0.3.0 of Hertz contains a path traversal vulnerability that stems from a failure of the normalizePath function to properly filter special elements in a resource or file path. An attacker could exploit this vulnerability to retrieve arbitrary files from the underlying file system via specially designed web requests.

CPENameOperatorVersion
cloudwego hertz veq0.3.0

0.001 Low

EPSS

Percentile

48.8%