blob: 1f5830e4c1917a474f642014caa3858f97fbf5db [file] [log] [blame]
{
"schema_version": "1.3.1",
"id": "GO-2022-0619",
"modified": "0001-01-01T00:00:00Z",
"published": "2022-08-15T18:05:29Z",
"aliases": [
"CVE-2022-1996",
"GHSA-r48q-9g5r-8q2h"
],
"summary": "Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3",
"details": "CORS filters that use an AllowedDomains configuration parameter can match domains outside the specified set, permitting an attacker to avoid the CORS policy.\n\nThe AllowedDomains configuration parameter is documented as a list of allowed origin domains, but values in this list are applied as regular expression matches. For example, an allowed domain of \"example.com\" will match the Origin header \"example.com.malicious.domain\".",
"affected": [
{
"package": {
"name": "github.com/emicklei/go-restful",
"ecosystem": "Go"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.0+incompatible"
}
]
}
],
"ecosystem_specific": {
"imports": [
{
"path": "github.com/emicklei/go-restful",
"symbols": [
"CrossOriginResourceSharing.Filter",
"CrossOriginResourceSharing.isOriginAllowed"
]
}
]
}
},
{
"package": {
"name": "github.com/emicklei/go-restful/v2",
"ecosystem": "Go"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "2.7.1"
}
]
}
],
"ecosystem_specific": {
"imports": [
{
"path": "github.com/emicklei/go-restful/v2",
"symbols": [
"CrossOriginResourceSharing.Filter",
"CrossOriginResourceSharing.isOriginAllowed"
]
}
]
}
},
{
"package": {
"name": "github.com/emicklei/go-restful/v3",
"ecosystem": "Go"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.8.0"
}
]
}
],
"ecosystem_specific": {
"imports": [
{
"path": "github.com/emicklei/go-restful/v3",
"symbols": [
"CrossOriginResourceSharing.Filter",
"CrossOriginResourceSharing.isOriginAllowed"
]
}
]
}
}
],
"references": [
{
"type": "FIX",
"url": "https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1"
},
{
"type": "WEB",
"url": "https://github.com/emicklei/go-restful/issues/489"
}
],
"database_specific": {
"url": "https://pkg.go.dev/vuln/GO-2022-0619"
}
}