GO-2022-0569 Path traversal in github.com/beego/beego and beego/v2

The leafInfo.match function uses path.join to deal with wildcard values which can lead to cross directory risk...

GO-2022-0572 Access control bypass via incorrect route lookup in github.com/beego/beego and beego/v2

An issue was discovered in the route lookup process in beego which attackers to bypass access control...

Directory Traversal

github.com/beego/beego is vulnerable to directory traversal vulnerability. The vulnerability exists due to the insecure use of path.join to deal with wildcardValues in leafInfo.match function, allowing an attacker to exploit directories outside of the intended scope...

Path Traversal in Beego

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

GHSA-95F9-94VC-665H Path Traversal in Beego

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

CVE-2022-31836

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

CVE-2022-31836

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

Cross site scripting

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

PT-2022-20952 · Beego · Beego

Name of the Vulnerable Software and Affected Versions: Beego versions 2.0.3 and below Description: The leafInfo.match function uses path.join to deal with wildcard values, which can lead to cross directory risk. This issue affects the Beego framework, potentially allowing unauthorized access to...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

CVE-2022-31836

CVE-2022-31836 describes a path traversal in Beego where the leafInfo.match() function uses path.join() to handle wildcard values, enabling a remote attacker to traverse directories via URLs containing ../../. Public details confirm the issue affects Beego v2.0.3 and earlier; the core vulnerabili...

CVE-2022-31836

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

Beego 路径遍历漏洞

Beego is an open source web framework based on the Go language. A security vulnerability exists in Beego v2.0.3 and earlier versions, which stems from the use of path.join by the leafInfo.match function to handle wildcardValues, which may lead to cross-directory risks...

CVE-2022-31836

The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...

GO-2022-0463 Access control bypass due to broad route matching in github.com/beego/beego and beego/v2

Routes in the beego HTTP router can match unintended patterns. This overly-broad matching may permit an attacker to bypass access controls. For example, the pattern "/a/b/:name" can match the URL "/a.xml/b/". This may bypass access control applied to the prefix "/a/"...

GHSA-HF4P-4J9R-3CVX Incorrect Default Permissions in Beego

The File Session Manager in Beego before 1.12.2 allows local users to read session files because of weak permissions for individual files...

Incorrect Default Permissions in Beego

The File Session Manager in Beego before 1.12.2 allows local users to read session files because of weak permissions for individual files...

Authentication Bypass

github.com/beego/beego is vulnerable to authentication bypass. When the /v1/yangeryl/:name route is configured, An attacker can access it by appending the .xml suffix into the url eg:/v1/yangeryl.xml/yangeryl.xml as the insufficient strings validation in the match function of tree.go...

GHSA-QX32-F6G6-FCFR Access control bypass in beego

The route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places e.g., p1.xml instead of p1...