« Volver al listado

CVE-2022-32190

Estado: ModificadaAlta (7.5)—

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Golang — GO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-32190",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "net/url",
          "versions": [
            {
              "status": "affected",
              "version": "1.19.0-0",
              "lessThan": "1.19.1",
              "versionType": "semver"
            }
          ],
          "packageName": "net/url",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "URL.JoinPath"
            },
            {
              "name": "JoinPath"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-13T18:15:14.507",
  "references": [
    {
      "url": "https://go.dev/cl/423514",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/54385",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2022-0988",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/cl/423514",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://go.dev/issue/54385",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2022-0988",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath(\"https://go.dev\", \"../go\") returns the URL \"https://go.dev/../go\", despite the JoinPath documentation stating that ../ path elements are removed from the result."
    },
    {
      "lang": "es",
      "value": "JoinPath y URL.JoinPath no eliminan los elementos de ruta ../ anexados a una ruta relativa. Por ejemplo, JoinPath(\"https://go.dev\", \"../go\") devuelve la URL \"https://go.dev/../go\", a pesar de que la documentación de JoinPath indica que los elementos de ruta ../ son eliminados del resultado"
    }
  ],
  "lastModified": "2026-06-17T04:46:49.913",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:golang:go:1.19.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "897B57CA-3B3C-4481-AB48-0DC0F9F7E88D"
            },
            {
              "criteria": "cpe:2.3:a:golang:go:1.19.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B24A1D2C-FF92-4C87-8377-41386988C5B4"
            },
            {
              "criteria": "cpe:2.3:a:golang:go:1.19.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "724EF8B4-9AA2-45CB-B55B-4697CC6D8353"
            },
            {
              "criteria": "cpe:2.3:a:golang:go:1.19.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "438A873A-3DAC-47BD-9919-2DFAC5C1F767"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}