CVE-2019-16354: Incorrect Permission Assignment for Critical Resource

August 2, 2021

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.

References

github.com/advisories/GHSA-f6px-w8rh-7r89
github.com/astaxie/beego/blob/develop/session/sess_file.go
github.com/astaxie/beego/issues/3763
github.com/beego/beego/issues/3763
github.com/beego/beego/pull/3975/commits/f99cbe0fa40936f2f8dd28e70620c559b6e5e2fd
nvd.nist.gov/vuln/detail/CVE-2019-16354

Code Behaviors & Features

Detect and mitigate CVE-2019-16354 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →