Skip to main content

Beego CVE-2019-16355

MEDIUM
Incorrect Default Permissions (CWE-276)
2019-09-16 cve@mitre.org
Privilege Escalation Beego
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 16, 2019 - 15:15 nvd
MEDIUM 5.5

DescriptionNVD

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.

AnalysisAI

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. Affected products include: Beego.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.

More in Beego

View all
CVE-2022-31836 CRITICAL POC
9.8 Jul 05

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to c
CVE-2022-31259 CRITICAL POC
9.8 May 21

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. Rated cr
CVE-2025-30223 CRITICAL POC
9.3 Mar 31

Beego is an open-source web framework for the Go programming language. Rated critical severity (CVSS 9.3), this vulnerab
CVE-2021-39391 MEDIUM POC
6.1 Sep 14

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request,

CVE-2024-40465 HIGH
8.8 Jul 31

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function i
CVE-2024-40464 HIGH
8.8 Jul 31

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located i
CVE-2024-55885 MEDIUM
6.9 Dec 12

beego is an open-source web framework for the Go programming language. Rated medium severity (CVSS 6.9), this vulnerabil
CVE-2019-16354 MEDIUM
4.7 Sep 16

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition invo

Same weakness CWE-276 – Incorrect Default Permissions

View all
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-11610 HIGH POC
8.8
CVE-2022-22948 MEDIUM POC
6.5
CVE-2017-8625 HIGH POC
8.8
CVE-2016-5425 HIGH POC
7.8
CVE-2024-55215 CRITICAL POC
9.8
CVE-2024-57604 CRITICAL POC
9.8
CVE-2025-60262 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2019-16355 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy