[
  {
    "id": "GO-2022-0463",
    "published": "2022-07-01T20:06:59Z",
    "modified": "2022-08-19T22:21:47Z",
    "aliases": [
      "CVE-2022-31259",
      "GHSA-qx32-f6g6-fcfr"
    ],
    "details": "Routes in the beego HTTP router can match unintended patterns.\nThis overly-broad matching may permit an attacker to bypass access\ncontrols.\n\nFor example, the pattern \"/a/b/:name\" can match the URL \"/a.xml/b/\".\nThis may bypass access control applied to the prefix \"/a/\".\n",
    "affected": [
      {
        "package": {
          "name": "github.com/beego/beego",
          "ecosystem": "Go"
        },
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.12.9"
              }
            ]
          }
        ],
        "database_specific": {
          "url": "https://pkg.go.dev/vuln/GO-2022-0463"
        },
        "ecosystem_specific": {
          "imports": [
            {
              "path": "github.com/beego/beego",
              "symbols": [
                "App.Run",
                "ControllerRegister.FindPolicy",
                "ControllerRegister.FindRouter",
                "ControllerRegister.ServeHTTP",
                "FilterRouter.ValidRouter",
                "InitBeegoBeforeTest",
                "Run",
                "RunWithMiddleWares",
                "TestBeegoInit",
                "Tree.Match",
                "Tree.match",
                "adminApp.Run"
              ]
            }
          ]
        }
      },
      {
        "package": {
          "name": "github.com/beego/beego/v2",
          "ecosystem": "Go"
        },
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "2.0.3"
              }
            ]
          }
        ],
        "database_specific": {
          "url": "https://pkg.go.dev/vuln/GO-2022-0463"
        },
        "ecosystem_specific": {
          "imports": [
            {
              "path": "github.com/beego/beego/v2/server/web",
              "symbols": [
                "AddNamespace",
                "Any",
                "AutoPrefix",
                "AutoRouter",
                "Compare",
                "CompareNot",
                "Controller.Bind",
                "Controller.BindForm",
                "Controller.BindXML",
                "Controller.BindYAML",
                "Controller.GetSecureCookie",
                "Controller.ParseForm",
                "Controller.Render",
                "Controller.RenderBytes",
                "Controller.RenderString",
                "Controller.Resp",
                "Controller.SaveToFile",
                "Controller.ServeFormatted",
                "Controller.ServeXML",
                "Controller.ServeYAML",
                "Controller.SetSecureCookie",
                "Controller.Trace",
                "Controller.URLFor",
                "Controller.XMLResp",
                "Controller.XSRFFormHTML",
                "Controller.XSRFToken",
                "Controller.YamlResp",
                "ControllerRegister.Add",
                "ControllerRegister.AddAuto",
                "ControllerRegister.AddAutoPrefix",
                "ControllerRegister.AddMethod",
                "ControllerRegister.AddRouterMethod",
                "ControllerRegister.Any",
                "ControllerRegister.CtrlAny",
                "ControllerRegister.CtrlDelete",
                "ControllerRegister.CtrlGet",
                "ControllerRegister.CtrlHead",
                "ControllerRegister.CtrlOptions",
                "ControllerRegister.CtrlPatch",
                "ControllerRegister.CtrlPost",
                "ControllerRegister.CtrlPut",
                "ControllerRegister.Delete",
                "ControllerRegister.FindPolicy",
                "ControllerRegister.FindRouter",
                "ControllerRegister.Get",
                "ControllerRegister.Handler",
                "ControllerRegister.Head",
                "ControllerRegister.Include",
                "ControllerRegister.Init",
                "ControllerRegister.InsertFilter",
                "ControllerRegister.Options",
                "ControllerRegister.Patch",
                "ControllerRegister.Post",
                "ControllerRegister.Put",
                "ControllerRegister.ServeHTTP",
                "ControllerRegister.URLFor",
                "CtrlAny",
                "CtrlDelete",
                "CtrlGet",
                "CtrlHead",
                "CtrlOptions",
                "CtrlPatch",
                "CtrlPost",
                "CtrlPut",
                "Date",
                "DateParse",
                "Delete",
                "Exception",
                "ExecuteTemplate",
                "ExecuteViewPathTemplate",
                "FilterRouter.ValidRouter",
                "FlashData.Error",
                "FlashData.Notice",
                "FlashData.Set",
                "FlashData.Store",
                "FlashData.Success",
                "FlashData.Warning",
                "Get",
                "GetConfig",
                "HTML2str",
                "Handler",
                "Head",
                "Htmlquote",
                "Htmlunquote",
                "HttpServer.Any",
                "HttpServer.AutoPrefix",
                "HttpServer.AutoRouter",
                "HttpServer.CtrlAny",
                "HttpServer.CtrlDelete",
                "HttpServer.CtrlGet",
                "HttpServer.CtrlHead",
                "HttpServer.CtrlOptions",
                "HttpServer.CtrlPatch",
                "HttpServer.CtrlPost",
                "HttpServer.CtrlPut",
                "HttpServer.Delete",
                "HttpServer.Get",
                "HttpServer.Handler",
                "HttpServer.Head",
                "HttpServer.Include",
                "HttpServer.InsertFilter",
                "HttpServer.Options",
                "HttpServer.Patch",
                "HttpServer.Post",
                "HttpServer.PrintTree",
                "HttpServer.Put",
                "HttpServer.RESTRouter",
                "HttpServer.Router",
                "HttpServer.RouterWithOpts",
                "HttpServer.Run",
                "Include",
                "InitBeegoBeforeTest",
                "InsertFilter",
                "LoadAppConfig",
                "MapGet",
                "Namespace.Any",
                "Namespace.AutoPrefix",
                "Namespace.AutoRouter",
                "Namespace.Cond",
                "Namespace.CtrlAny",
                "Namespace.CtrlDelete",
                "Namespace.CtrlGet",
                "Namespace.CtrlHead",
                "Namespace.CtrlOptions",
                "Namespace.CtrlPatch",
                "Namespace.CtrlPost",
                "Namespace.CtrlPut",
                "Namespace.Delete",
                "Namespace.Filter",
                "Namespace.Get",
                "Namespace.Handler",
                "Namespace.Head",
                "Namespace.Include",
                "Namespace.Namespace",
                "Namespace.Options",
                "Namespace.Patch",
                "Namespace.Post",
                "Namespace.Put",
                "Namespace.Router",
                "NewControllerRegister",
                "NewControllerRegisterWithCfg",
                "NewHttpServerWithCfg",
                "NewHttpSever",
                "NewNamespace",
                "NotNil",
                "Options",
                "ParseForm",
                "Patch",
                "Policy",
                "Post",
                "PrintTree",
                "Put",
                "RESTRouter",
                "ReadFromRequest",
                "RenderForm",
                "Router",
                "RouterWithOpts",
                "Run",
                "RunWithMiddleWares",
                "TestBeegoInit",
                "Tree.AddRouter",
                "Tree.AddTree",
                "Tree.Match",
                "Tree.match",
                "URLFor",
                "URLMap.GetMap",
                "URLMap.GetMapData",
                "adminApp.Run",
                "adminController.AdminIndex",
                "adminController.Healthcheck",
                "adminController.ListConf",
                "adminController.ProfIndex",
                "adminController.PrometheusMetrics",
                "adminController.QpsIndex",
                "adminController.TaskStatus",
                "beegoAppConfig.Bool",
                "beegoAppConfig.DefaultBool"
              ]
            }
          ]
        }
      }
    ],
    "references": [
      {
        "type": "FIX",
        "url": "https://github.com/beego/beego/pull/4958"
      },
      {
        "type": "FIX",
        "url": "https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd"
      },
      {
        "type": "WEB",
        "url": "https://beego.vip"
      },
      {
        "type": "WEB",
        "url": "https://github.com/beego/beego/issues/4946"
      },
      {
        "type": "WEB",
        "url": "https://github.com/beego/beego/pull/4954"
      },
      {
        "type": "WEB",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31259"
      },
      {
        "type": "WEB",
        "url": "https://github.com/advisories/GHSA-qx32-f6g6-fcfr"
      }
    ]
  },
  {
    "id": "GO-2022-0569",
    "published": "2022-08-23T13:24:17Z",
    "modified": "2022-08-23T13:24:17Z",
    "aliases": [
      "CVE-2022-31836",
      "GHSA-95f9-94vc-665h"
    ],
    "details": "The leafInfo.match() function uses path.join()\nto deal with wildcard values which can lead to cross directory risk.\n",
    "affected": [
      {
        "package": {
          "name": "github.com/beego/beego",
          "ecosystem": "Go"
        },
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.12.11"
              }
            ]
          }
        ],
        "database_specific": {
          "url": "https://pkg.go.dev/vuln/GO-2022-0569"
        },
        "ecosystem_specific": {
          "imports": [
            {
              "path": "github.com/beego/beego",
              "symbols": [
                "Tree.Match"
              ]
            }
          ]
        }
      },
      {
        "package": {
          "name": "github.com/beego/beego/v2",
          "ecosystem": "Go"
        },
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "2.0.0"
              },
              {
                "fixed": "2.0.4"
              }
            ]
          }
        ],
        "database_specific": {
          "url": "https://pkg.go.dev/vuln/GO-2022-0569"
        },
        "ecosystem_specific": {
          "imports": [
            {
              "path": "github.com/beego/beego/v2/server/web",
              "symbols": [
                "Tree.Match"
              ]
            }
          ]
        }
      }
    ],
    "references": [
      {
        "type": "FIX",
        "url": "https://github.com/beego/beego/pull/5025"
      },
      {
        "type": "FIX",
        "url": "https://github.com/beego/beego/pull/5025/commits/ea5ae58d40589d249cf577a053e490509de2bf57"
      },
      {
        "type": "WEB",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31836"
      },
      {
        "type": "WEB",
        "url": "https://github.com/advisories/GHSA-95f9-94vc-665h"
      }
    ]
  },
  {
    "id": "GO-2022-0572",
    "published": "2022-08-22T17:56:17Z",
    "modified": "2022-08-23T19:54:38Z",
    "aliases": [
      "CVE-2021-30080",
      "GHSA-28r6-jm5h-mrgg"
    ],
    "details": "An issue was discovered in the route lookup process in\nbeego which attackers to bypass access control.\n",
    "affected": [
      {
        "package": {
          "name": "github.com/beego/beego",
          "ecosystem": "Go"
        },
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "0"
              }
            ]
          }
        ],
        "database_specific": {
          "url": "https://pkg.go.dev/vuln/GO-2022-0572"
        },
        "ecosystem_specific": {
          "imports": [
            {
              "path": "github.com/beego/beego",
              "symbols": [
                "Tree.Match"
              ]
            }
          ]
        }
      },
      {
        "package": {
          "name": "github.com/beego/beego/v2",
          "ecosystem": "Go"
        },
        "ranges": [
          {
            "type": "SEMVER",
            "events": [
              {
                "introduced": "2.0.0"
              },
              {
                "fixed": "2.0.3"
              }
            ]
          }
        ],
        "database_specific": {
          "url": "https://pkg.go.dev/vuln/GO-2022-0572"
        },
        "ecosystem_specific": {
          "imports": [
            {
              "path": "github.com/beego/beego/v2/server/web",
              "symbols": [
                "Tree.Match"
              ]
            }
          ]
        }
      }
    ],
    "references": [
      {
        "type": "FIX",
        "url": "https://github.com/beego/beego/pull/4459"
      },
      {
        "type": "FIX",
        "url": "https://github.com/beego/beego/commit/d5df5e470d0a8ed291930ae802fd7e6b95226519"
      },
      {
        "type": "WEB",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30080"
      },
      {
        "type": "WEB",
        "url": "https://github.com/advisories/GHSA-28r6-jm5h-mrgg"
      }
    ]
  }
]