Lucene search

K
osvGoogleOSV:GO-2022-1027
HistoryOct 05, 2022 - 6:02 p.m.

Path traversal in github.com/cloudwego/hertz

2022-10-0518:02:53
Google
osv.dev
6
path traversal
windows
sanitization
static file serving
filesystem root
vulnerability
github

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

49.0%

Improper path sanitization on Windows permits path traversal attacks. Static file serving with the Static or StaticFS functions allows an attacker to access files from outside the filesystem root.

This vulnerability does not affect non-Windows systems.

CPENameOperatorVersion
github.com/cloudwego/hertzlt0.3.1

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

49.0%