Description

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

Remediation

References

CVE-2022-31836

Related Vulnerabilities

Highcharts JS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-29489)

WordPress Plugin Simple Slideshow Manager Multiple Unspecified Vulnerabilities (2.1)

Collabtive Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-3246)

WordPress Plugin PromoBar by BestWebSoft Cross-Site Scripting (1.1.0)

Drupal Core 9.1.x Cross-Site Scripting (9.1.0 - 9.1.13)

Severity

Critical

Classification

CVE-2022-31836 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities