CVE-2022-31836
published 2022-07-05CVE-2022-31836: The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
PriorityP342critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.25%
65.8th percentile
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| beego | beego | <= 2.0.3 | — |
| github.com | beego_beego | >= 0 < 1.12.11 | 1.12.11 |
| github.com | beego_beego_v2 | >= 2.0.0 < 2.0.4 | 2.0.4 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Path traversal in github.com/beego/beego and beego/v2
osv·2022-08-23
CVE-2022-31836 Path traversal in github.com/beego/beego and beego/v2
Path traversal in github.com/beego/beego and beego/v2
The leafInfo.match() function uses path.join() to deal with wildcard values which can lead to cross directory risk.
OSV
Path Traversal in Beego
osv·2022-07-06
CVE-2022-31836 [CRITICAL] Path Traversal in Beego
Path Traversal in Beego
The `leafInfo.match()` function in Beego v2.0.3 and below uses `path.join()` to deal with wildcardvalues which can lead to cross directory risk.
GHSA
Path Traversal in Beego
ghsa·2022-07-06
CVE-2022-31836 [CRITICAL] CWE-22 Path Traversal in Beego
Path Traversal in Beego
The `leafInfo.match()` function in Beego v2.0.3 and below uses `path.join()` to deal with wildcardvalues which can lead to cross directory risk.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-05
Published