4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
25.5%
The filename parameter of the Context.FileAttachment function is not
properly sanitized. A maliciously crafted filename can cause the
Content-Disposition header to be sent with an unexpected filename value or
otherwise modify the Content-Disposition header. For example, a filename of
“setup.bat";x=.txt” will be sent as a file named “setup.bat”. If the
FileAttachment function is called with names provided by an untrusted
source, this may permit an attacker to cause a file to be served with a
name different than provided. Maliciously crafted attachment file name can
modify the Content-Disposition header.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | golang-github-gin-gonic-gin | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-github-gin-gonic-gin | < any | UNKNOWN |
ubuntu | 22.04 | noarch | golang-github-gin-gonic-gin | < any | UNKNOWN |
ubuntu | 23.10 | noarch | golang-github-gin-gonic-gin | < any | UNKNOWN |
ubuntu | 24.04 | noarch | golang-github-gin-gonic-gin | < any | UNKNOWN |
github.com/gin-gonic/gin/issues/3555
github.com/gin-gonic/gin/pull/3556
github.com/gin-gonic/gin/releases/tag/v1.9.1
launchpad.net/bugs/cve/CVE-2023-29401
nvd.nist.gov/vuln/detail/CVE-2023-29401
pkg.go.dev/vuln/GO-2023-1737
security-tracker.debian.org/tracker/CVE-2023-29401
www.cve.org/CVERecord?id=CVE-2023-29401
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
25.5%