Lucene search

GitHub Advisory DatabaseGHSA-H395-QCRW-5VMQ

HistoryJun 23, 2021 - 5:53 p.m.

Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin

2021-06-2317:53:21

CWE-113

CWE-444

GitHub Advisory Database

github.com

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

59.0%

JSON

When gin is exposed directly to the internet, a client’s IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7.

Affected configurations

Vulners

Node

github.com\/gingonic\/ginRange<1.7.7

CPENameOperatorVersion
github.com/gin-gonic/ginlt1.7.7

CPE	Name	Operator	Version
	github.com/gin-gonic/gin	lt	1.7.7

References

github.com/advisories/GHSA-h395-qcrw-5vmq

github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9

github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937

github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711

github.com/gin-gonic/gin/issues/2232

github.com/gin-gonic/gin/issues/2473

github.com/gin-gonic/gin/issues/2862

github.com/gin-gonic/gin/pull/2474

github.com/gin-gonic/gin/pull/2474#23issuecomment-729696437

github.com/gin-gonic/gin/pull/2632

github.com/gin-gonic/gin/pull/2675

github.com/gin-gonic/gin/pull/2844

github.com/gin-gonic/gin/pull/2844/files#diff-e6ce689a25eaef174c2dd51fe869fabbe04a6c6afbd416b23eda138c82e761baR1432

github.com/gin-gonic/gin/releases/tag/v1.7.0

github.com/gin-gonic/gin/releases/tag/v1.7.7

nvd.nist.gov/vuln/detail/CVE-2020-28483

pkg.go.dev/vuln/GO-2021-0052

snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

59.0%

JSON

Related for GHSA-H395-QCRW-5VMQ