CVE-2021-23772

Katalog CVE

CVSS 8.8 · High EPSS 1,8%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada iris-go iris. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

Rincian

Terbit di NVD

24 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170 exploit · patch · advisory pihak ketiga