GitHub Advisoryadvisory · Go

GHSA-f6px-w8rh-7r89 Beego has a file creation race condition

MEDIUM Published 2021-08-02 Modified 2023-09-15 Official page ↗
Aliases
CVE-2019-16354
Ecosystem
Go
Packages
github.com/beego/beego, github.com/astaxie/beego
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-362, CWE-732
Reviewed
2021-07-22

Affected packages

• Go github.com/beego/beego: < 1.12.2 → fixed in 1.12.2 • Go github.com/astaxie/beego: < 1.12.2 → fixed in 1.12.2

Description

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.

Related

Alias · CVE (1)

  • CVE-2019-16354 The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation… vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References