| modules: |
| - module: aahframe.work |
| versions: |
| - fixed: 0.12.4 |
| vulnerable_at: 0.12.3 |
| packages: |
| - package: aahframe.work |
| symbols: |
| - HTTPEngine.Handle |
| derived_symbols: |
| - Application.Run |
| - Application.ServeHTTP |
| - Application.Start |
| description: | |
| Due to improper santization of user input, HTTPEngine.Handle allows |
| for directory traversal, allowing an attacker to read files outside of |
| the target directory that the server has permission to read. |
| published: 2021-04-14T20:04:52Z |
| ghsas: |
| - GHSA-vp56-r7qv-783v |
| credit: '@snyff' |
| references: |
| - fix: https://github.com/go-aah/aah/pull/267 |
| - fix: https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec |
| - report: https://github.com/go-aah/aah/issues/266 |
| cve_metadata: |
| id: CVE-2020-36559 |
| cwe: 'CWE 23: Relative Path Traversal' |
