{"id":"CVE-2022-31259","published":"2022-05-21T00:00:00Z","modified":"2024-08-03T07:11:39Z","title":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control","vendor":null,"product":null,"tier":"tail","description":{"text":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.22158,"percentile":0.97665,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/beego/beego/issues/4946","tags":[]},{"url":"https://beego.vip","tags":[]},{"url":"https://github.com/beego/beego/tree/v2.0.2","tags":[]},{"url":"https://github.com/advisories/GHSA-qx32-f6g6-fcfr","tags":[]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.53}]},"affected":[{"ecosystem":"Go","package":"github.com/beego/beego/v2","vulnerableRanges":["<2.0.3"],"patched":["2.0.3"],"from":["GHSA-qx32-f6g6-fcfr","GO-2022-0463"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/beego/beego","vulnerableRanges":["<1.12.9"],"patched":["1.12.9"],"from":["GHSA-qx32-f6g6-fcfr","GO-2022-0463"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/astaxie/beego","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2022-0463"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5053","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-beego-beego-v2-cve-2021-30080","parents":[{"from":"CVE-2021-30080","to":"CVE-2022-31259","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/web/tree.go"],"commits":["https://github.com/beego/beego/commit/d5df5e470d0a8ed291930ae802fd7e6b95226519","https://github.com/beego/beego/commit/228576173a236c81a2122923fcf8099ad294e009","https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd"],"basis":"shared function","functions":["match"]},{"kind":"similar","provenance":"machine","score":0.59,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2022-31259","to":"CVE-2022-31836","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego","fromFixed":"1.12.9","toFixed":"1.12.11","daysApart":45},{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego/v2","fromFixed":"2.0.3","toFixed":"2.0.4","daysApart":45},{"kind":"same-code","provenance":"machine","files":["tree.go"],"commits":["https://github.com/beego/beego/commit/228576173a236c81a2122923fcf8099ad294e009","https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd","https://github.com/beego/beego/commit/ea5ae58d40589d249cf577a053e490509de2bf57"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2021-27116","published":"2022-04-05","fixed":"2.0.2","kev":false,"link":{"from":"CVE-2021-27116","to":"CVE-2022-31259","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego/v2","fromFixed":"2.0.2","toFixed":"2.0.3","daysApart":46}]}},{"cve":"CVE-2021-27117","published":"2022-04-05","fixed":"2.0.2","kev":false},{"cve":"CVE-2021-39391","published":"2021-09-14","fixed":"2.0.2","kev":false},{"cve":"CVE-2021-30080","published":"2022-04-05","fixed":"2.0.3","kev":false},{"cve":"CVE-2022-31259","published":"2022-05-21","fixed":"2.0.3","kev":false},{"cve":"CVE-2022-31836","published":"2022-07-05","fixed":"2.0.4","kev":false},{"cve":"CVE-2024-40464","published":"2024-07-31","fixed":"2.2.1","kev":false},{"cve":"CVE-2024-40465","published":"2024-07-31","fixed":"2.2.1","kev":false}],"package":"Go:github.com/beego/beego/v2"}}