Em resumo
- CVE-2022-30580 é uma vulnerabilidade ALTO (CVSS 7.8) que afeta stdlib, go (golang).
- Chance de exploração nos próximos 30 dias (EPSS): 0.70%, maior que 53.2% das vulnerabilidades.
- Correção: atualize para 1.18.3, 1.17.11 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.18.0-0, < 1.18.3< 1.17.11
| 1.18.31.17.11
|
| go | ≥ 1.18.0, < 1.18.3< 1.17.11
| 1.18.31.17.11
|
Description
On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset will unintentionally trigger execution of any binaries in the working directory named either "..com" or "..exe".
NVD description
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free