GitHub Advisory DatabaseGHSA-CRXJ-HRMP-4RWFLabstack Echo Open Redirect vulnerability
9.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
0.026 Low
EPSS
Percentile
90.3%
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF). Version 4.9.0 contains a patch for the issue.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/labstack/echo/v4 | lt | 4.9.0 |
References
github.com/advisories/GHSA-crxj-hrmp-4rwf
github.com/labstack/echo/commit/0ac4d74402391912ff6da733bb09fd4c3980b4e1
github.com/labstack/echo/issues/2259
github.com/labstack/echo/pull/2260
github.com/labstack/echo/pull/2260/commits/3154abd1401554fe4d1c09ec550506d8625fc042
github.com/labstack/echo/releases/tag/v4.9.0
nvd.nist.gov/vuln/detail/CVE-2022-40083
pkg.go.dev/vuln/GO-2022-1031
Related
9.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
0.026 Low
EPSS
Percentile
90.3%