CVEvulnerability
CVE-2020-36559
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-12-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
Description
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Affected configurations
• aahframework aah (< 0.12.4)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec Patch, Third Party Advisory
- https://github.com/go-aah/aah/issues/266 Issue Tracking, Third Party Advisory
- https://github.com/go-aah/aah/pull/267 Third Party Advisory
- https://pkg.go.dev/vuln/GO-2020-0033 Third Party Advisory
- https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec Patch, Third Party Advisory
- https://github.com/go-aah/aah/issues/266 Issue Tracking, Third Party Advisory
- https://github.com/go-aah/aah/pull/267 Third Party Advisory
- https://pkg.go.dev/vuln/GO-2020-0033 Third Party Advisory