{"id":"CVE-2022-31836","published":"2022-07-05T00:00:00Z","modified":"2024-08-03T07:26:01Z","title":"The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to…","vendor":null,"product":null,"tier":"tail","description":{"text":"The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01663,"percentile":0.76645,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/beego/beego/issues/4961","tags":[]},{"url":"https://github.com/advisories/GHSA-95f9-94vc-665h","tags":[]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":15.33}]},"affected":[{"ecosystem":"Go","package":"github.com/beego/beego","vulnerableRanges":["<1.12.11"],"patched":["1.12.11"],"from":["GHSA-95f9-94vc-665h","GO-2022-0569"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/beego/beego/v2","vulnerableRanges":[">=2.0.0, <2.0.4"],"patched":["2.0.4"],"from":["GHSA-95f9-94vc-665h","GO-2022-0569"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/astaxie/beego","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2022-0569"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6301","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-beego-beego-v2-cve-2021-30080","parents":[{"from":"CVE-2022-31259","to":"CVE-2022-31836","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego","fromFixed":"1.12.9","toFixed":"1.12.11","daysApart":45},{"kind":"version-step","provenance":"source","package":"Go:github.com/beego/beego/v2","fromFixed":"2.0.3","toFixed":"2.0.4","daysApart":45},{"kind":"same-code","provenance":"machine","files":["tree.go"],"commits":["https://github.com/beego/beego/commit/228576173a236c81a2122923fcf8099ad294e009","https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd","https://github.com/beego/beego/commit/ea5ae58d40589d249cf577a053e490509de2bf57"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2019-16354","published":"2019-09-16","fixed":"1.12.2","kev":false},{"cve":"CVE-2019-16355","published":"2019-09-16","fixed":"1.12.2","kev":false},{"cve":"CVE-2022-31259","published":"2022-05-21","fixed":"1.12.9","kev":false},{"cve":"CVE-2022-31836","published":"2022-07-05","fixed":"1.12.11","kev":false},{"cve":"CVE-2021-27116","published":"2022-04-05","fixed":"2.0.2","kev":false},{"cve":"CVE-2021-27117","published":"2022-04-05","fixed":"2.0.2","kev":false}],"package":"Go:github.com/beego/beego"}}