PT-2020-15731 · Google+6 · Go+6
Published
2020-08-19
·
Updated
2024-06-15
·
CVE-2020-24553
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Go versions 1.14.8 and earlier, 1.15.x before 1.15.1
Description
The issue allows cross-site scripting (XSS) because
text/html is the default for CGI/FCGI handlers that lack a Content-Type header. This can be exploited if an attacker can control any part of the contents of a response. The estimated number of potentially affected devices worldwide is not specified.Recommendations
For Go versions 1.14.8 and earlier, update to version 1.14.8 or later.
For Go versions 1.15.x before 1.15.1, update to version 1.15.1 or later.
As a temporary workaround, consider explicitly setting the
Content-Type header in handlers to avoid defaulting to text/html.
Avoid not setting the Content-Type header explicitly on any attacker-controlled file, as this is unsafe and should be avoided.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Go
Linuxmint
Red Hat
Suse
Ubuntu