Search criteria

1 vulnerability by github.com/labstack/echo/v4

CVE-2020-36565 (GCVE-0-2020-36565)

Vulnerability from cvelistv5 – Published: 2022-12-07 16:14 – Updated: 2025-04-23 15:38
VLAI?
Title
Directory traversal on Windows in github.com/labstack/echo/v4
Summary
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
Go
References
Impacted products
Vendor Product Version
github.com/labstack/echo/v4 github.com/labstack/echo/v4 Affected: 0 , < 4.1.18-0.20201215153152-4422e3b66b9f (semver)
Create a notification for this product.
Credits
@little-cui (Apache ServiceComb)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:30:08.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/labstack/echo/pull/1718"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2021-0051"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-36565",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:38:06.629425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T15:38:30.467Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/labstack/echo/v4",
          "platforms": [
            "windows"
          ],
          "product": "github.com/labstack/echo/v4",
          "programRoutines": [
            {
              "name": "common.static"
            },
            {
              "name": "Echo.Static"
            },
            {
              "name": "Group.Static"
            }
          ],
          "vendor": "github.com/labstack/echo/v4",
          "versions": [
            {
              "lessThan": "4.1.18-0.20201215153152-4422e3b66b9f",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "@little-cui (Apache ServiceComb)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:06.359Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://github.com/labstack/echo/pull/1718"
        },
        {
          "url": "https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2021-0051"
        }
      ],
      "title": "Directory traversal on Windows in github.com/labstack/echo/v4"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2020-36565",
    "datePublished": "2022-12-07T16:14:43.946Z",
    "dateReserved": "2022-07-29T18:52:35.508Z",
    "dateUpdated": "2025-04-23T15:38:30.467Z",
    "requesterUserId": "7d08541a-cd0a-42e2-8f81-76e6ceb65fc3",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}