GitHub Advisoryadvisory · Go

GHSA-c77f-4rgj-jfr4 Cross-site Scripting in Beego

MEDIUM Published 2021-09-15 Modified 2023-12-07 Official page ↗
Aliases
CVE-2021-39391
Ecosystem
Go
Packages
github.com/beego/beego/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-64, CWE-79
Reviewed
2021-09-15

Affected packages

• Go github.com/beego/beego/v2: < 2.0.2 → fixed in 2.0.2

Description

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.

Related

Alias · CVE (1)

  • CVE-2021-39391 Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated… vulnerability

Weakness · CWE (2)

  • CWE-64 Windows Shortcut Following (.LNK) weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References