| id: report | |
| modules: | |
| - module: github.com/gin-gonic/gin | |
| versions: | |
| - fixed: 1.6.0 | |
| packages: | |
| - package: github.com/gin-gonic/gin | |
| symbols: | |
| - defaultLogFormatter | |
| description: | | |
| The default Formatter for the Logger middleware (LoggerConfig.Formatter), | |
| which is included in the Default engine, allows attackers to inject arbitrary | |
| log entries by manipulating the request path. | |
| credits: | |
| - '@thinkerou <thinkerou@gmail.com>' | |
| references: | |
| - fix: https://github.com/gin-gonic/gin/pull/2237 | |
| - fix: https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d | |
| cve_metadata: | |
| id: CVE-9999-0001 | |
| cwe: 'CWE-20: Improper Input Validation' | |
| description: | | |
| Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 | |
| allows remote attackers to inject arbitrary log lines. |