GitHub Advisoryadvisory · Go

GHSA-mpg8-8x9c-p9gv MaysWind ezBookkeeping has Improper Privilege Management

CRITICAL Published 2025-02-13 Modified 2025-02-20 Official page ↗
Aliases
CVE-2024-57604
Ecosystem
Go
Packages
github.com/mayswind/ezbookkeeping
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-276
Reviewed
2025-02-20

Affected packages

• Go github.com/mayswind/ezbookkeeping: <= 0.7.0 (no fix yet)

Description

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.

Related

Alias · CVE (1)

  • CVE-2024-57604 An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component. vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-276 Incorrect Default Permissions weakness

References