high7.5
CVE-2020-36559
ahh vulnerable to Path Traversal
Impact
Due to improper santization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/go-aah/aah | < 0.12.4 | 0.12.4 |
| go | aahframe.work | < 0.12.4 | 0.12.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aahframework | Aah | before 0.12.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec
- https://github.com/go-aah/aah/issues/266
- https://github.com/go-aah/aah/pull/267
- https://pkg.go.dev/vuln/GO-2020-0033
- https://github.com/advisories/GHSA-vp56-r7qv-783v
- https://nvd.nist.gov/vuln/detail/CVE-2020-36559