8.8

CVE-2021-23772

Exploit
This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Iris-go ≫ Iris SwPlatformgo Version <= 12.1.8
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha2 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha3 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha4 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Iris-go ≫ Iris Version12.2.0 Updatealpha5 SwPlatformgo
   Golang ≫ Go Version < 1.7.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.88% 0.75
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
report@snyk.io 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.