« Volver al listado

CVE-2021-23772

Estado: ModificadaAlta (8.8)—

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Iris-go — Iris

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-23772",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "report@snyk.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "report@snyk.io",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "github.com/kataras/iris",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "n/a",
          "product": "github.com/kataras/iris/v12",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-24T12:15:07.697",
  "references": [
    {
      "url": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder."
    },
    {
      "lang": "es",
      "value": "Esto afecta a todas las versiones del paquete github.com/kataras/iris; todas las versiones del paquete github.com/kataras/iris/v12. Un manejo no seguro de los nombres de archivo durante la carga usando el método UploadFormFiles puede permitir a atacantes escribir en ubicaciones arbitrarias fuera de la carpeta de destino designada"
    }
  ],
  "lastModified": "2026-06-17T03:38:52.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:iris-go:iris:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA26C17D-DFA8-4AB5-9E4C-6D5E0A375F6E",
              "versionEndIncluding": "12.1.8"
            },
            {
              "criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36735110-76CB-42E1-A4DC-E75FF8D35844"
            },
            {
              "criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha2:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4801442A-7188-4FBB-B699-569B7EAC0FC8"
            },
            {
              "criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha3:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "911993F3-EC67-4E85-A0B2-598CA8CB3B14"
            },
            {
              "criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha4:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4ED1FF1C-46DA-4E7B-BC42-00847843A82A"
            },
            {
              "criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha5:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA784B81-3C4F-4253-92C9-0B16431BE486"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "355C01B5-DC2D-4992-BCD9-B22E68BC7858",
              "versionEndExcluding": "1.7.5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "report@snyk.io"
}