CVE-2022-29804

2022-08-1020:15:34

CWE-22

web.nvd.nist.gov

122

cve-2022-29804

path traversal

directory traversal

windows

go 1.17.11

go 1.18.3

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

53.0%

JSON

Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

Affected configurations

Nvd

Node

microsoftwindowsMatch-

AND

golanggoRange<1.17.11

golanggoRange1.18.0–1.18.3

VendorProductVersionCPE
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
golanggo*cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
golang	go	*	cpe:2.3:a:golang:go::::::::

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "path/filepath",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "path/filepath",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.17.11",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.18.0-0",
        "lessThan": "1.18.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "windows"
    ],
    "programRoutines": [
      {
        "name": "Clean"
      }
    ],
    "defaultStatus": "unaffected"
  }
]