PT-2019-14644 · Beego · Beego
Publicado
2019-09-16
·
Atualizado
2022-05-24
·
CVE-2019-16354
CVSS v3.1
4.7
Média
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Beego versions 1.10.0 through 1.12.1
Beego versions prior to 1.12.2
Description
The issue concerns a race condition and weak permissions in the File Session Manager, allowing local users with filesystem access to read arbitrary session data. This could potentially expose sensitive information.
Recommendations
For Beego versions 1.10.0 through 1.12.1, update to version 1.12.2 or later to resolve the issue.
For Beego versions prior to 1.12.2, update to version 1.12.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to session files and directories to minimize the risk of exploitation.
Correção
Incorrect Permission
Race Condition
Incorrect Default Permissions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Beego