PT-2022-8069 · Unknown · Pastebinit

Published 2022-12-30 · Updated 2024-08-21 · CVE-2018-25059

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions pastebinit versions up to 0.2.2

Description A vulnerability was found in pastebinit, classified as problematic. The issue affects the function pasteHandler of the file server.go. The manipulation of the argument r.URL.Path leads to path traversal. Upgrading to version 0.2.3 can address this issue.

Recommendations For pastebinit versions up to 0.2.2, upgrade to version 0.2.3 to address the issue. As a temporary workaround, consider restricting access to the pasteHandler function in the server.go file until the upgrade is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-25059

GHSA-CWH7-28VG-JMPR

GO-2022-1212

Affected Products

Pastebinit

References · 14

• https://github.com/jessfraz/pastebinit/releases/tag/v0.2.3 · Patch
• https://github.com/jessfraz/pastebinit/commit/1af2facb6d95976c532b7f8f82747d454a092272 · Patch
• https://github.com/jessfraz/pastebinit/pull/3 · Patch
• https://osv.dev/vulnerability/CVE-2018-25059 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1212 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cwh7-28vg-jmpr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25059 · Security Note
• https://github.com/jessfraz/pastebinit · Note
• https://t.me/cibsecurity/55552 · Telegram Post
• https://vuldb.com/?id.217040 · Note
• https://vuldb.com/?ctiid.217040 · Note
• https://github.com/advisories/GHSA-cwh7-28vg-jmpr · Note
• https://t.me/cvenotify/41014 · Telegram Post
• https://t.me/cvenotify/41602 · Telegram Post