CVE-2022-29804: falha em Go standard library path/filepath
Path traversal via Clean on Windows in path/filepath
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.4%
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
Produtos afetados
Go standard library · path/filepathCVEs relacionadas — Go standard library path/filepath
No mesmo produto, das mais perigosas para as menos.
CVE-2023-45283—Insecure parsing of Windows paths with a \??\ prefix in path/filepathEPSS 3.3%CVE-2022-30632—Stack exhaustion on crafted paths in path/filepathEPSS 2.2%CVE-2022-41722—Path traversal on Windows in path/filepathEPSS 1.7%CVE-2023-45284MEDIUMIncorrect detection of reserved device names on Windows in path/filepathEPSS 1.1%CVE-2024-8244LOWWalk/WalkDir in path/filepath susceptible to symlink raceEPSS 0.2%