PT-2022-9950 · Beego · Beego

Published 2022-04-05 · Updated 2024-05-14 · CVE-2021-30080

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions beego versions prior to 1.12.11 beego versions through 2.0.1

Description An issue was discovered in the route lookup process in beego that allows attackers to bypass access control.

Recommendations For versions prior to 1.12.11, update to version 1.12.11 or later. For versions through 2.0.1, update to a version later than 2.0.1. As a temporary workaround, consider restricting access to sensitive routes to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-30080

GHSA-28R6-JM5H-MRGG

GO-2022-0572

Affected Products

Beego

References · 11

• https://github.com/beego/beego/commit/d5df5e470d0a8ed291930ae802fd7e6b95226519 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30080 · Security Note
• https://osv.dev/vulnerability/GHSA-28r6-jm5h-mrgg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30080 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0572 · Vendor Advisory
• https://github.com/beego/beego · Note
• https://github.com/beego/beego/releases/tag/v1.12.11 · Note
• https://github.com/beego/beego/pull/4459 · Note
• https://pkg.go.dev/vuln/GO-2022-0572 · Note
• https://t.me/cibsecurity/40183 · Telegram Post
• https://t.me/cvenotify/28463 · Telegram Post