GitHub Advisoryadvisory · Go

GHSA-2v6v-q994-xvxx Privilege escalation in beego

HIGH Published 2022-04-06 Modified 2022-04-15 Official page ↗
Aliases
CVE-2021-27117
Ecosystem
Go
Packages
github.com/beego/beego/v2, github.com/beego/beego
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-59
Reviewed
2022-04-07

Affected packages

• Go github.com/beego/beego/v2: >= 2.0.0, < 2.0.2 → fixed in 2.0.2 • Go github.com/beego/beego: < 2.0.2 (no fix yet)

Description

beego is an open-source, high-performance web framework for the Go programming language. An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.

Related

Alias · CVE (1)

  • CVE-2021-27117 An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References