module: github.com/astaxie/beego
package: github.com/astaxie/beego/session
versions:
  - fixed: v1.12.2-0.20200613154013-bac2b31afecc
description: |
  Session data is stored using permissive permissions, allowing local users
  with filesystem access to read arbitrary data.
cves:
  - CVE-2019-16354
credit: "@nicowaisman"
symbols:
  - FileProvider.SessionRead
  - FileProvider.SessionRegenerate
links:
  pr: https://github.com/beego/beego/pull/3975
  commit: https://github.com/beego/beego/commit/bac2b31afecc65d9a89f9e473b8006c5edc0c8d1
  context:
    - https://github.com/beego/beego/issues/3763