CVE-2022-31259 - Vulnerability Details - OpenCVE

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Beego	Beego

Configuration 1 [-]

OR	cpe:2.3:a:beego:beego::::::::
	cpe:2.3:a:beego:beego::::::::

No data.

References

Link	Providers
https://beego.vip
https://github.com/advisories/GHSA-qx32-f6g6-fcfr
https://github.com/beego/beego/issues/4946
https://github.com/beego/beego/tree/v2.0.2

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-05-21T00:00:00

Updated: 2024-08-03T07:11:39.910Z

Reserved: 2022-05-21T00:00:00

Link: CVE-2022-31259

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-05-21T19:15:52.990

Modified: 2024-11-21T07:04:14.560

Link: CVE-2022-31259

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F171202-4C00-439C-8669-9B761BD207AD", "versionEndIncluding": "1.12.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6428BA0-2A42-4DF3-8040-258676340F57", "versionEndIncluding": "2.0.2", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1)."}, {"lang": "es", "value": "El proceso de b\u00fasqueda de rutas en beego versiones hasta 1.12.4 y versiones2.x hasta 2.0.2, permite a atacantes omitir el control de acceso. Cuando es configurada una ruta /p1/p2/:name, los atacantes pueden acceder a ella al a\u00f1adir .xml en varios lugares (por ejemplo, p1.xml en lugar de p1)"}], "id": "CVE-2022-31259", "lastModified": "2024-11-21T07:04:14.560", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-21T19:15:52.990", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://beego.vip"}, {"source": "cve@mitre.org", "url": "https://github.com/advisories/GHSA-qx32-f6g6-fcfr"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/beego/beego/issues/4946"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/beego/beego/tree/v2.0.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://beego.vip"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/advisories/GHSA-qx32-f6g6-fcfr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/beego/beego/issues/4946"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/beego/beego/tree/v2.0.2"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}