Description

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

Remediation

References

CVE-2022-31836

Related Vulnerabilities

MySQL CVE-2020-14643 Vulnerability (CVE-2020-14643)

WordPress 4.2.x Multiple Vulnerabilities (4.2 - 4.2.6)

Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-40035)

Oracle Database Server CVE-2012-0552 Vulnerability (CVE-2012-0552)

MySQL CVE-2021-2481 Vulnerability (CVE-2021-2481)

Severity

Critical

Classification

CVE-2022-31836 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities