GitHub Advisoryadvisory · Go

GHSA-5qww-56gc-f66c GoCast OS Command Injection vulnerability

CRITICAL Published 2024-12-20 Modified 2024-12-26 Official page ↗
Aliases
CVE-2024-28892
Ecosystem
Go
Packages
github.com/mayuresh82/gocast
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2024-12-26

Affected packages

• Go github.com/mayuresh82/gocast: <= 1.1.3 (no fix yet)

Description

An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-28892 An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References