← Back

CVE-2021-23772

nvd nist
Published: Dec 24, 2021Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

Affected (6)

Products: Iris Go: Iris
Iris Go
1 product
Iris
Configuration A
6 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Iris Go
Iris
Up to 12.1.8
Iris
Version 12.2.0 alpha2
Iris
Version 12.2.0 alpha3
Iris
Version 12.2.0 alpha4
Iris
Version 12.2.0 alpha5
Iris
Version 12.2.0 alpha
Running on/withPlatform Versions
Golang
Go
Before 1.7.5

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (6)

Source: report@snyk.io
PatchThird Party Advisory
Source: report@snyk.io
ExploitPatchThird Party Advisory
Source: report@snyk.io
ExploitPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatchThird Party Advisory

Timeline

No history available yet.