Vulnerabilities

TI-2023-13781 CVE-2023-29401 · GHSA-2c4m-59x9-fr2g

Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

MEDIUM 53

The filename parameter of the Context.FileAttachment function is not properly sanitized.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00482 Published 2023-06-08 Partial fix · 1.9.1 CWE-494

TI-2023-11349 CVE-2023-26125 · GHSA-3vp4-m3rf-835h

Improper input validation in github.com/gin-gonic/gin

HIGH 71

Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00905 Published 2023-05-04 Partial fix · 1.9.0 CWE-20

TI-2020-18795 CVE-2020-36567 · GHSA-6vm3-jj99-7229

Arbitrary log line injection in github.com/gin-gonic/gin

HIGH 72

Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01545 Published 2022-12-27 Partial fix · 1.6.0 CWE-116

TI-2020-17293 CVE-2020-28483 · GHSA-h395-qcrw-5vmq

HTTP response splitting in github.com/gin-gonic/gin

LOW 34

This affects all versions of package github.com/gin-gonic/gin.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01332 Published 2021-01-20 Partial fix · 1.7.7 CWE-444

Vulnerabilities

Filters

Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

Improper input validation in github.com/gin-gonic/gin

Arbitrary log line injection in github.com/gin-gonic/gin

HTTP response splitting in github.com/gin-gonic/gin