CVE-2022-32190
Failure to strip relative path components in net/url
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
JoinPath y URL.JoinPath no eliminan los elementos de ruta ../ anexados a una ruta relativa. Por ejemplo, JoinPath("https://go.dev", "../go") devuelve la URL "https://go.dev/../go", a pesar de que la documentación de JoinPath indica que los elementos de ruta ../ son eliminados del resultado
A flaw was found in the golang package. The JoinPath doesn't remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-31 CVE Reserved
- 2022-09-13 CVE Published
- 2024-04-05 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://groups.google.com/g/golang-announce/c/x49AQzIVX-s | Mailing List |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://go.dev/cl/423514 | 2023-11-07 | |
| https://go.dev/issue/54385 | 2023-11-07 | |
| https://pkg.go.dev/vuln/GO-2022-0988 | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-32190 | 2024-01-31 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2124668 | 2024-01-31 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | 1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0" | - |
Affected
| ||||||
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | 1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0" | beta1 |
Affected
| ||||||
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | 1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0" | rc1 |
Affected
| ||||||
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | 1.19.0 Search vendor "Golang" for product "Go" and version "1.19.0" | rc2 |
Affected
| ||||||