CVE-2020-36559 json
Path Traversal in aahframe.work
published 5y ago modified 4mo ago also GHSA-vp56-r7qv-783v , GO-2020-0033 , EUVD-2022-7748
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Patch / fix
- go github.com/go-aah/aah 0.12.4
- go aahframe.work 0.12.4
- aahframe.work aahframe.work 0.12.4
- github.com/go-aah/aah@881dc9f commit
- github.com/go-aah/aah#267 pull request
Is CVE-2020-36559 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/go-aah/aah | <0.12.4 |
0.12.4 |
| go | aahframe.work | <0.12.4 |
0.12.4 |
Affected products
- aahframe.work aahframe.work
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/go-aah/aah/pull/267
web, third-party-advisory, patch
-
github.com
/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec
web, patch, third-party-advisory
-
github.com
/go-aah/aah/issues/266
web, issue-tracking, third-party-advisory, report
-
pkg.go.dev
/vuln/GO-2020-0033
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-36559
advisory
-
github.com
/go-aah/aah
package
Sources
- CVE List CVE-2020-36559
- GitHub Advisory GHSA-vp56-r7qv-783v
- NVD CVE-2020-36559
- OSV GO-2020-0033
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.