CVE-2020-24553
MEDIUM6.1EPSS 0.15%Cross-site scripting in net/http/cgi and net/http/fcgi
發布日:2022/1/13修改日:2026/4/28
也稱為:DEBIAN-CVE-2020-24553
描述
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
受影響套件(3)
- Bitnami/golangfrom 0, < 1.14.8, >= 1.15.0, < 1.15.1
- Debian/golang-1.15from 0, < 1.15.2-1
- Go/stdlibfrom 0, < 1.14.8, >= 1.15.0-0, < 1.15.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
參考連結(16)
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-24553
- PATCHhttps://go.dev/cl/252179
- PATCHhttps://go.googlesource.com/go/+/4f5cd0c0331943c7ec72df3b827d972584f77833
- REPORThttps://go.dev/issue/40928
- WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html
- WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html
- WEBhttp://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html
- WEBhttp://seclists.org/fulldisclosure/2020/Sep/5
- WEBhttps://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs
- WEBhttps://groups.google.com/g/golang-announce/c/8wqlSbkLdPs
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/
- WEBhttps://nvd.nist.gov/vuln/detail/CVE-2020-24553
- WEBhttps://security.netapp.com/advisory/ntap-20200924-0003/
- WEBhttps://www.oracle.com/security-alerts/cpuApr2021.html
- WEBhttps://www.oracle.com//security-alerts/cpujul2021.html
- WEBhttps://www.redteam-pentesting.de/advisories/rt-sa-2020-004