Gin's default logger allows unsanitized input that can allow remote attackers to inject arbitrary log lines

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2020-36567 · ADVISORY
• gin-gonic/gin#2237 · WEB
• gin-gonic/gin commit a71af9c · WEB
• gin-gonic/gin · PACKAGE
• pkg.go.dev/vuln/GO-2020-0001 · WEB

Lỗ hổng khác của github.com/gin-gonic/gin

• CVE-2019-25211NGHIÊM TRỌNG 9.1parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.com…
• CVE-2023-29401TRUNG BÌNH 4.3The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Conten…
• CVE-2023-26125CAO 7.3Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a s…
• CVE-2020-28483CAO 7.1This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by…