PT-2019-14645 · Beego · Beego

Publicado

2019-09-16

·

Atualizado

2022-05-24

·

CVE-2019-16355

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Beego versions 1.10.0 through 1.12.1
Description The issue concerns weak permissions for session files, allowing local users to read session data. This is due to the File Session Manager in Beego storing session data with permissive permissions, enabling local users with filesystem access to read arbitrary data. A race condition involving file creation within a directory with weak permissions also contributes to this issue.
Recommendations For Beego versions 1.10.0 through 1.12.1, update to version 1.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to session files to minimize the risk of exploitation.

Exploit

Correção

Incorrect Permission

Race Condition

Incorrect Default Permissions

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-732CWE-362CWE-276

Identificadores relacionados

CVE-2019-16355
GHSA-F6PX-W8RH-7R89
GHSA-HF4P-4J9R-3CVX
GO-2021-0084

Produtos afetados

Beego