GitHub Advisoryadvisory · Go

GHSA-f93f-55c2-8c89 Casdoor arbitrary file deletion vulnerability via uploadFile function

HIGH Published 2022-12-07 Modified 2022-12-08 Official page ↗

Aliases: CVE-2022-44942
Ecosystem: Go
Packages: github.com/casdoor/casdoor
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses: CWE-22
Reviewed: 2022-12-07

Affected packages

• Go github.com/casdoor/casdoor: < 1.126.1 → fixed in 1.126.1

Description

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the `uploadFile` function.

Related

Alias · CVE (1)

CVE-2022-44942 Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function. vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References