CVE-2019-16354
published 2019-09-16CVE-2019-16354: The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory…
PriorityP419medium4.7CVSS 3.1
AVLACHPRLUINSUCHINAN
EPSS
0.20%
9.8th percentile
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| beego | beego | — | — |
| github.com | astaxie_beego | >= 0 < 1.12.2 | 1.12.2 |
| github.com | beego_beego | >= 0 < 1.12.2 | 1.12.2 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Incorrect Default Permissions in Beego
osv·2022-05-24
CVE-2019-16354 [MEDIUM] Incorrect Default Permissions in Beego
Incorrect Default Permissions in Beego
The File Session Manager in Beego before 1.12.2 allows local users to read session files because of weak permissions for individual files.
GHSA
Beego has a file creation race condition
ghsa·2021-08-02
CVE-2019-16354 [MEDIUM] CWE-362 Beego has a file creation race condition
Beego has a file creation race condition
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
OSV
Beego has a file creation race condition
osv·2021-08-02
CVE-2019-16354 [MEDIUM] Beego has a file creation race condition
Beego has a file creation race condition
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
OSV
Incorrect permissions for critical resource in github.com/astaxie/beego
osv·2021-04-14
CVE-2019-16354 Incorrect permissions for critical resource in github.com/astaxie/beego
Incorrect permissions for critical resource in github.com/astaxie/beego
Session data is stored using permissive permissions, allowing local users with filesystem access to read arbitrary data.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-09-16
Published