PT-2019-14644 · Beego · Beego

Published

2019-09-16

·

Updated

2022-05-24

·

CVE-2019-16354

CVSS v3.1

4.7

Medium

VectorAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Beego versions 1.10.0 through 1.12.1 Beego versions prior to 1.12.2
Description The issue concerns a race condition and weak permissions in the File Session Manager, allowing local users with filesystem access to read arbitrary session data. This could potentially expose sensitive information.
Recommendations For Beego versions 1.10.0 through 1.12.1, update to version 1.12.2 or later to resolve the issue. For Beego versions prior to 1.12.2, update to version 1.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to session files and directories to minimize the risk of exploitation.

Fix

Incorrect Permission

Race Condition

Incorrect Default Permissions

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-732CWE-362CWE-276

Related Identifiers

CVE-2019-16354
GHSA-F6PX-W8RH-7R89
GHSA-HF4P-4J9R-3CVX
GO-2021-0084

Affected Products

Beego