A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
References
| Link | Resource |
|---|---|
| https://go.dev/cl/468123 | Issue Tracking |
| https://go.dev/issue/57274 | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E | Mailing List Vendor Advisory |
| https://pkg.go.dev/vuln/GO-2023-1568 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
10 Mar 2023, 15:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:a:golang:go:1.20.0:-:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://pkg.go.dev/vuln/GO-2023-1568 - Vendor Advisory | |
| References | (MISC) https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E - Mailing List, Vendor Advisory | |
| References | (MISC) https://go.dev/cl/468123 - Issue Tracking | |
| References | (MISC) https://go.dev/issue/57274 - Issue Tracking | |
| CWE | CWE-22 | |
| First Time |
Golang go
Microsoft windows Microsoft Golang |
28 Feb 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-28 18:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-41722
Mitre link : CVE-2022-41722
CVE.ORG link : CVE-2022-41722
JSON object : View
Products Affected
microsoft
- windows
golang
- go
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')