id: GO-2020-0001
modules:
    - module: github.com/gin-gonic/gin
      versions:
        - fixed: 1.6.0
      vulnerable_at: 1.5.0
      packages:
        - package: github.com/gin-gonic/gin
          symbols:
            - LoggerWithConfig
          derived_symbols:
            - Default
            - Logger
            - LoggerWithFormatter
            - LoggerWithWriter
summary: Arbitrary log line injection in github.com/gin-gonic/gin
description: |-
    The default Formatter for the Logger middleware (LoggerConfig.Formatter), which
    is included in the Default engine, allows attackers to inject arbitrary log
    entries by manipulating the request path.
published: 2021-04-14T20:04:52Z
ghsas:
    - GHSA-6vm3-jj99-7229
credits:
    - '@thinkerou <thinkerou@gmail.com>'
references:
    - fix: https://github.com/gin-gonic/gin/pull/2237
    - fix: https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d
cve_metadata:
    id: CVE-2020-36567
    cwe: CWE-117 Improper Output Neutralization for Logs
    description: |-
        Unsanitized input in the default logger in github.com/gin-gonic/gin before
        v1.6.0 allows remote attackers to inject arbitrary log lines.