GitHub Advisoryadvisory · Go

GHSA-xq3x-grrj-fj6x sjqzhang go-fastdfs vulnerable to path traversal

CRITICAL Published 2023-04-02 Modified 2024-05-20 Official page ↗
Aliases
CVE-2023-1800
Ecosystem
Go
Packages
github.com/sjqzhang/go-fastdfs
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-24, CWE-434
Reviewed
2023-04-07

Affected packages

• Go github.com/sjqzhang/go-fastdfs: < 1.4.5-0.20230408141131-61cbff5124c6 → fixed in 1.4.5-0.20230408141131-61cbff5124c6

Description

sjqzhang go-fastdfs up to 1.4.3 is vulnerable to path traversal in the function upload of the file `/group1/upload` of the component `File Upload Handler`. The attack may be launched remotely and the exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2023-1800 A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. vulnerability

Weakness · CWE (3)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-24 Path Traversal: '../filedir' weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References