GitHub Advisoryadvisory · Go
GHSA-hf4p-4j9r-3cvx Incorrect Default Permissions in Beego
MEDIUM
Official page ↗
- Aliases
- CVE-2019-16355
- Ecosystem
- Go
- Packages
- github.com/beego/beego, github.com/astaxie/beego
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-276
- Reviewed
- 2024-02-01
Affected packages
• Go github.com/beego/beego: < 1.12.2 → fixed in 1.12.2
• Go github.com/astaxie/beego: < 1.12.2 → fixed in 1.12.2
Description
The File Session Manager in Beego before 1.12.2 allows local users to read session files because of weak permissions for individual files.
Related
Alias · CVE (1)
- CVE-2019-16355 The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. vulnerability
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16355 advisory
- https://github.com/beego/beego/issues/3763 web
- https://github.com/beego/beego/pull/3975 web
- https://github.com/beego/beego/pull/3975/commits/f99cbe0fa40936f2f8dd28e70620c559b6e5e2fd web
- https://github.com/beego/beego/commit/bac2b31afecc65d9a89f9e473b8006c5edc0c8d1 web