Description

The route lookup process in beego through 1.12.4 and 2.x through 2.0.2 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).

Remediation

References

CVE-2022-31259

Related Vulnerabilities

WordPress Plugin Product Slider For WooCommerce Lite includes Backdoor [Only if downloaded via the vendor website] (1.1.5)

WordPress 3.9.x Multiple Vulnerabilities (3.9 - 3.9.12)

WordPress Plugin Show-Hide/Collapse-Expand Cross-Site Scripting (1.2.5)

WordPress Plugin I Recommend This SQL Injection (3.7.7)

WordPress Plugin FormCraft-Premium WordPress Form Builder Cross-Site Scripting (3.2.31)

Severity

Critical

Classification

CVE-2022-31259 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities