Lucene search

K
osvGoogleOSV:GHSA-3VP4-M3RF-835H
HistoryMay 04, 2023 - 6:30 a.m.

Improper input validation in github.com/gin-gonic/gin

2023-05-0406:30:12
Google
osv.dev
8
github.com
gin-gonic/gin
input validation
vulnerability
x-forwarded-prefix
cache poisoning

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%

Versions of the package github.com/gin-gonic/gin before version 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.

Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.

CPENameOperatorVersion
github.com/gin-gonic/ginlt1.9.0

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%