GitHub Advisoryadvisory · Go

GHSA-vp56-r7qv-783v ahh vulnerable to Path Traversal

HIGH Published 2022-12-28 Modified 2024-05-20 Official page ↗
Aliases
CVE-2020-36559
Ecosystem
Go
Packages
github.com/go-aah/aah, aahframe.work
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-12-30

Affected packages

• Go github.com/go-aah/aah: < 0.12.4 → fixed in 0.12.4 • Go aahframe.work: < 0.12.4 → fixed in 0.12.4

Description

Due to improper santization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

Related

Alias · CVE (1)

  • CVE-2020-36559 Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References