GHSA-qx32-f6g6-fcfrCriticalCVSS 9.8

Access control bypass in beego

Published
May 22, 2022
Last Modified
August 29, 2023

🔗 CVE IDs covered (1)

CVE-2022-31259 →

📋 Description

The route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).

🎯 Affected products2

  • go/github.com/beego/beego/v2:< 2.0.3
  • go/github.com/beego/beego:< 1.12.9

🔗 References (9)