{"id":"CVE-2022-31259","published":"2022-05-21T00:00:00Z","modified":"2024-08-03T07:11:39Z","title":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control","vendor":null,"product":null,"tier":"tail","description":{"text":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.22158,"percentile":0.97672,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/beego/beego/issues/4946","tags":[]},{"url":"https://beego.vip","tags":[]},{"url":"https://github.com/beego/beego/tree/v2.0.2","tags":[]},{"url":"https://github.com/advisories/GHSA-qx32-f6g6-fcfr","tags":[]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.53}]},"affected":[{"ecosystem":"Go","package":"github.com/beego/beego/v2","vulnerableRanges":["<2.0.3"],"patched":["2.0.3"],"from":["GHSA-qx32-f6g6-fcfr","GO-2022-0463"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/beego/beego","vulnerableRanges":["<1.12.9"],"patched":["1.12.9"],"from":["GHSA-qx32-f6g6-fcfr","GO-2022-0463"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/astaxie/beego","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2022-0463"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5053","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-27116","published":"2022-04-05","fixed":"2.0.2","kev":false,"link":{"from":"CVE-2021-27116","to":"CVE-2022-31259","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego/v2","fromFixed":"2.0.2","toFixed":"2.0.3","daysApart":46}]}},{"cve":"CVE-2021-27117","published":"2022-04-05","fixed":"2.0.2","kev":false},{"cve":"CVE-2021-39391","published":"2021-09-14","fixed":"2.0.2","kev":false},{"cve":"CVE-2021-30080","published":"2022-04-05","fixed":"2.0.3","kev":false},{"cve":"CVE-2022-31259","published":"2022-05-21","fixed":"2.0.3","kev":false},{"cve":"CVE-2022-31836","published":"2022-07-05","fixed":"2.0.4","kev":false,"link":{"from":"CVE-2022-31259","to":"CVE-2022-31836","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego","fromFixed":"1.12.9","toFixed":"1.12.11","daysApart":45},{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego/v2","fromFixed":"2.0.3","toFixed":"2.0.4","daysApart":45}]}},{"cve":"CVE-2024-40464","published":"2024-07-31","fixed":"2.2.1","kev":false},{"cve":"CVE-2024-40465","published":"2024-07-31","fixed":"2.2.1","kev":false}],"package":"Go:github.com/beego/beego/v2"}}