8.8

CVE-2021-23772

Exploit

Arbitrary File Write

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Iris-go ≫ Iris SwPlatformgo Version <= 12.1.8
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha2 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha3 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha4 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha5 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.82% 0.76
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
report@snyk.io 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169
Patch
Third Party Advisory
Exploit
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170
Patch
Third Party Advisory
Exploit