Github.Com Gofiber Fiber vulnerabilities

CVE-2024-38513 [CRITICAL] CWE-384 Session Middleware Token Injection Vulnerability Session Middleware Token Injection Vulnerability A security vulnerability has been identified in the Fiber session middleware where a user can supply their own session_id value, leading to the creation of a session with that key. ## Impact The identified vulnerability is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in

CVE-2023-41338 [MEDIUM] CWE-670 Fiber unauthorized access vulnerability in `ctx.IsFromLocal()` Fiber unauthorized access vulnerability in `ctx.IsFromLocal()` ### Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the [ctx.IsFromLocal()](https://docs.gofiber.io/api/ctx#isfromlocal) method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it'

CVE-2020-15111 [MEDIUM] CWE-74 CRLF vulnerability in Fiber CRLF vulnerability in Fiber ### Impact The filename that is given in [c.Attachment()](https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. ### Steps to rep