GitHub Advisoryadvisory · Go

GHSA-fjgq-224f-fq37 Goa vulnerable to path traversal

HIGH Published 2022-12-28 Modified 2023-03-01 Official page ↗
Aliases
CVE-2019-25073
Ecosystem
Go
Packages
github.com/goadesign/goa, goa.design/goa, goa.design/goa/v3
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-12-30

Affected packages

• Go github.com/goadesign/goa: < 1.4.3 → fixed in 1.4.3 • Go goa.design/goa: < 1.4.3 → fixed in 1.4.3 • Go goa.design/goa/v3: < 3.0.9 → fixed in 3.0.9

Description

Improper path santiziation in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory

Related

Alias · CVE (1)

  • CVE-2019-25073 Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References