Veracode Vulnerability DatabaseVERACODE:36979Path Traversal
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
24.1%
github.com/golang/go is vulnerable to path traversal. The vulnerability exists because the JoinPath function of url.go does not properly remove the relative elements from the start of the path when the first path element is “”, allowing an attacker to access files outside the expected directory through the urls such as https://go.dev", "../go
References
github.com/advisories/GHSA-q856-gh5w-3vwg
github.com/golang/go/commit/28335508913a46e05ef0c04a18e8a1a6beb775ec
github.com/golang/go/issues/54385
github.com/golang/go/pull/54390
go.dev/cl/423514
go.dev/issue/54385
groups.google.com/g/golang-announce/c/x49AQzIVX-s
lists.fedoraproject.org/archives/list/[email protected]/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/
pkg.go.dev/vuln/GO-2022-0988
secdb.alpinelinux.org/edge/community.yaml
secdb.alpinelinux.org/v3.16/community.yaml
security.gentoo.org/glsa/202209-26
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
24.1%