Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).
AnalysisAI
The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1). Affected products include: Beego. Version information: before 1.12.9.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to c
Beego is an open-source web framework for the Go programming language. Rated critical severity (CVSS 9.3), this vulnerab
Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request,
The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for indivi
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function i
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located i
beego is an open-source web framework for the Go programming language. Rated medium severity (CVSS 6.9), this vulnerabil
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition invo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today