Access control bypass in beego

The route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

Access control bypass in beego

The route lookup process in beego through 1.12.4 and 2.x through 2.0.2 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

Access control bypass in beego

The route lookup process in beego through 1.12.4 and 2.x through 2.0.2 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

CVE-2022-31259

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

CVE-2022-31259

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

Improper access control

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

PT-2022-20646 · Beego · Beego

Name of the Vulnerable Software and Affected Versions: beego versions prior to 1.12.9 beego versions 2.x prior to 2.0.3 Description: The route lookup process in beego allows attackers to bypass access control by appending .xml in various places when a route is configured. For example, when a...

CVE-2022-31259

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

Beego 访问控制错误漏洞

Beego is an open source web framework based on the Go language. An access control error vulnerability exists in Beego, which can be exploited by an attacker to bypass access control. The following products and versions are affected: version 1.12.4 and earlier, version 2.x before 2.0.2...

Authentication Bypass Using an Alternate Path or Channel

The route lookup process in beego through 1.12.4 and 2.x through 2.0.2 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

CVE-2022-31259

CVE-2022-31259 affects the Beego HTTP router. A flaw in route matching allows bypassing access control by appending .xml in a /p1/p2/:name route, enabling access to otherwise restricted paths. Affected: Beego before 1.12.9 and Beego 2.x before 2.0.3. Impact ranges from basic to elevated access de...

CVE-2022-31259

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...

Access Control Bypass

github.com/beego/beego is vulnerable to access control bypass. The vulnerability exists because matching router to runObject & parameters in tree.go is not handled properly during route lookup process...

Symlink Attack

github.com/beego/beego is vulnerable to symlink attack. Lack of sufficient check for the existence of files created allows an attacker to use MemProf command to trigger the symbolic link attack locally...

Symlink Attack

github.com/beego/beego is vulnerable to symlink attack. Lack of sufficient check for the existence of files created allows an attacker to use MemProf and GetCPUProfile commands to trigger the symbolic link attack locally...

GHSA-FFJP-66MX-3QPJ Privilege escalation in beego

An issue was discovered in file profile.go. The MemProf and GetCPUProfile functions do not correctly check whether the created file exists. As a result attackers can launch attacks symlink attacks locally. Attackers can use this vulnerability to escalate privileges...

GHSA-28R6-JM5H-MRGG Access control bypass in Beego

An issue was discovered in the route lookup process in beego through 2.0.1, allows attackers to bypass access control...

GHSA-2V6V-Q994-XVXX Privilege escalation in beego

beego is an open-source, high-performance web framework for the Go programming language. An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally...

Privilege escalation in beego

beego is an open-source, high-performance web framework for the Go programming language. An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally...

Privilege escalation in beego

An issue was discovered in file profile.go. The MemProf and GetCPUProfile functions do not correctly check whether the created file exists. As a result attackers can launch attacks symlink attacks locally. Attackers can use this vulnerability to escalate privileges...