CVE-2023-29401

Katalog CVE

CVSS 4.3 · Medium EPSS 0,49%

Kerentanan Download of Code Without Integrity Check pada gin-gonic gin. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

Rincian

Terbit di NVD

8 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gin-gonic/gin/pull/3556 issue tracking · patch
• https://pkg.go.dev/vuln/GO-2023-1737 advisory pihak ketiga
• https://github.com/gin-gonic/gin/issues/3555 exploit · issue tracking
• https://github.com/gin-gonic/gin/releases/tag/v1.9.1 release notes