astaxie vulnerabilities

Products

• github.com/astaxie/beego 4

Latest astaxie CVEs

Newest publication first

1. CVE-2022-31836 Path Traversal in Beego

   Published 2022-07-05

   Critical·CVSS 9.8 EPSS 1.7%

   The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

2. CVE-2022-31259 Access control bypass in beego

   Published 2022-05-21

   Critical·CVSS 9.8 EPSS 22.2%

   The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).

3. CVE-2021-30080 Access control bypass in Beego

   Published 2022-04-05

   Critical·CVSS 9.8 EPSS 1.3%

   An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.

4. CVE-2019-16354 Incorrect Default Permissions in Beego

   Published 2019-09-16

   Medium·CVSS 5.5 EPSS 0.20%

   The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.