CVE-2021-4236 Panic or authentication bypass in github.com/ecnepsnai/web

2022-12-2721:13:45

www.cve.org

cve-2021-4236

web sockets

authentication bypass

github

9.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.4%

JSON

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.

CNA Affected

[
  {
    "vendor": "github.com/ecnepsnai/web",
    "product": "github.com/ecnepsnai/web",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/ecnepsnai/web",
    "versions": [
      {
        "version": "1.4.0",
        "lessThan": "1.5.2",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Server.socketHandler"
      },
      {
        "name": "Server.Socket"
      }
    ],
    "defaultStatus": "unaffected"
  }
]