« Volver al listado

CVE-2019-25073

Estado: ModificadaAlta (7.5)—

La sanitización inadecuada de rutas en github.com/goadesign/goa antes de v3.0.9, v2.0.10 o v1.4.3 permite a atacantes remotos leer archivos fuera del directorio deseado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Goa.design — GOA

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-25073",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2019-25073",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-11T22:50:42.800105Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "github.com/goadesign/goa",
          "product": "github.com/goadesign/goa",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.4.3",
              "versionType": "semver"
            }
          ],
          "packageName": "github.com/goadesign/goa",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Controller.FileHandler"
            },
            {
              "name": "Service.ListenAndServe"
            },
            {
              "name": "Service.ListenAndServeTLS"
            },
            {
              "name": "Service.Serve"
            },
            {
              "name": "mux.ServeHTTP"
            }
          ]
        },
        {
          "vendor": "goa.design/goa",
          "product": "goa.design/goa",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.4.3",
              "versionType": "semver"
            }
          ],
          "packageName": "goa.design/goa",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Controller.FileHandler"
            }
          ]
        },
        {
          "vendor": "goa.design/goa/v3",
          "product": "goa.design/goa/v3",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.0.9",
              "versionType": "semver"
            }
          ],
          "packageName": "goa.design/goa/v3",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "Controller.FileHandler"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-27T22:15:11.397",
  "references": [
    {
      "url": "https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://github.com/goadesign/goa/pull/2388",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2020-0032",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/goadesign/goa/pull/2388",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2020-0032",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory."
    },
    {
      "lang": "es",
      "value": "La sanitización inadecuada de rutas en github.com/goadesign/goa antes de v3.0.9, v2.0.10 o v1.4.3 permite a atacantes remotos leer archivos fuera del directorio deseado."
    }
  ],
  "lastModified": "2026-06-17T02:31:36.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:goa.design:goa:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "582B45BB-E80A-48AB-A34B-38B1BD3BBB35",
              "versionEndExcluding": "1.4.3"
            },
            {
              "criteria": "cpe:2.3:a:goa.design:goa:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75C6F03D-BA0C-4C98-9A68-DEF5CA00979B",
              "versionEndExcluding": "2.0.10",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:goa.design:goa:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38E49757-1AA2-4B70-A3E4-CF7DA5E785AC",
              "versionEndExcluding": "3.0.9",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}