8.8

CVE-2021-23772

Exploit

Arbitrary File Write

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Iris-go ≫ Iris SwPlatform go Version <= 12.1.8
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version 12.2.0 Update alpha SwPlatform go
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version 12.2.0 Update alpha2 SwPlatform go
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version 12.2.0 Update alpha3 SwPlatform go
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version 12.2.0 Update alpha4 SwPlatform go
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version 12.2.0 Update alpha5 SwPlatform go
   Golang ≫ Go Version < 1.7.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.82% 0.76
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Snyk 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169
Patch
Third Party Advisory
Exploit
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170
Patch
Third Party Advisory
Exploit