modules:
  - module: github.com/gin-gonic/gin
    versions:
      - fixed: 1.6.0
    vulnerable_at: 1.5.0
    packages:
      - package: github.com/gin-gonic/gin
        symbols:
          - LoggerWithConfig
        derived_symbols:
          - Default
          - Logger
          - LoggerWithFormatter
          - LoggerWithWriter
description: |
    The default Formatter for the Logger middleware (LoggerConfig.Formatter),
    which is included in the Default engine, allows attackers to inject arbitrary
    log entries by manipulating the request path.
published: 2021-04-14T20:04:52Z
ghsas:
  - GHSA-6vm3-jj99-7229
credit: '@thinkerou <thinkerou@gmail.com>'
references:
  - fix: https://github.com/gin-gonic/gin/pull/2237
  - fix: https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d
cve_metadata:
    id: CVE-2020-36567
    cwe: CWE-117 Improper Output Neutralization for Logs
    description: |
        Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0
        allows remote attackers to inject arbitrary log lines.