GitHub Advisoryadvisory · Go

GHSA-ffjp-66mx-3qpj Privilege escalation in beego

HIGH Published 2022-04-06 Modified 2022-04-07 Official page ↗
Aliases
CVE-2021-27116
Ecosystem
Go
Packages
github.com/beego/beego/v2, github.com/beego/beego
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-59
Reviewed
2022-04-07

Affected packages

• Go github.com/beego/beego/v2: >= 2.0.0, < 2.0.2 → fixed in 2.0.2 • Go github.com/beego/beego: < 2.0.2 (no fix yet)

Description

An issue was discovered in file profile.go. The MemProf and GetCPUProfile functions do not correctly check whether the created file exists. As a result attackers can launch attacks symlink attacks locally. Attackers can use this vulnerability to escalate privileges.

Related

Alias · CVE (1)

  • CVE-2021-27116 An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References