id: GO-2021-0084
modules:
    - module: github.com/astaxie/beego
      versions:
        - fixed: 1.12.2-0.20200613154013-bac2b31afecc
      vulnerable_at: 1.12.2-0.20200610083815-4ad699b7b813
      packages:
        - package: github.com/astaxie/beego/session
          symbols:
            - FileProvider.SessionRead
            - FileProvider.SessionRegenerate
summary: Incorrect permissions for critical resource in github.com/astaxie/beego
description: |-
    Session data is stored using permissive permissions, allowing local users with
    filesystem access to read arbitrary data.
published: 2021-04-14T20:04:52Z
cves:
    - CVE-2019-16354
ghsas:
    - GHSA-f6px-w8rh-7r89
credits:
    - '@nicowaisman'
references:
    - fix: https://github.com/beego/beego/pull/3975
    - fix: https://github.com/beego/beego/commit/bac2b31afecc65d9a89f9e473b8006c5edc0c8d1
    - web: https://github.com/beego/beego/issues/3763