CVE-2021-23772

{"containers": {"cna": {"affected": [{"product": "github.com/kataras/iris", "vendor": "n/a", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "github.com/kataras/iris/v12", "vendor": "n/a", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Snyk Security Team"}], "datePublic": "2021-12-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Arbitrary File Write", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-12-24T12:05:14.000Z", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169"}, {"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08"}], "title": "Arbitrary File Write", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2021-12-24T12:00:27.806259Z", "ID": "CVE-2021-23772", "STATE": "PUBLIC", "TITLE": "Arbitrary File Write"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "github.com/kataras/iris", "version": {"version_data": [{"version_affected": ">=", "version_value": "0"}]}}]}, "vendor_name": "n/a"}, {"product": {"product_data": [{"product_name": "github.com/kataras/iris/v12", "version": {"version_data": [{"version_affected": ">=", "version_value": "0"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Snyk Security Team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Arbitrary File Write"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169"}, {"name": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170"}, {"name": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08", "refsource": "MISC", "url": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:14:08.732Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2021-23772", "datePublished": "2021-12-24T12:05:14.635Z", "dateReserved": "2021-01-08T00:00:00.000Z", "dateUpdated": "2024-09-16T20:03:06.172Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "github.com/kataras/iris", "vendor": "n/a", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "github.com/kataras/iris/v12", "vendor": "n/a", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "report@snyk.io"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:iris-go:iris:*:*:*:*:*:go:*:*", "matchCriteriaId": "EA26C17D-DFA8-4AB5-9E4C-6D5E0A375F6E", "versionEndIncluding": "12.1.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha:*:*:*:go:*:*", "matchCriteriaId": "36735110-76CB-42E1-A4DC-E75FF8D35844", "vulnerable": true}, {"criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha2:*:*:*:go:*:*", "matchCriteriaId": "4801442A-7188-4FBB-B699-569B7EAC0FC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha3:*:*:*:go:*:*", "matchCriteriaId": "911993F3-EC67-4E85-A0B2-598CA8CB3B14", "vulnerable": true}, {"criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha4:*:*:*:go:*:*", "matchCriteriaId": "4ED1FF1C-46DA-4E7B-BC42-00847843A82A", "vulnerable": true}, {"criteria": "cpe:2.3:a:iris-go:iris:12.2.0:alpha5:*:*:*:go:*:*", "matchCriteriaId": "CA784B81-3C4F-4253-92C9-0B16431BE486", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "355C01B5-DC2D-4992-BCD9-B22E68BC7858", "versionEndExcluding": "1.7.5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder."}, {"lang": "es", "value": "Esto afecta a todas las versiones del paquete github.com/kataras/iris; todas las versiones del paquete github.com/kataras/iris/v12. Un manejo no seguro de los nombres de archivo durante la carga usando el m\u00e9todo UploadFormFiles puede permitir a atacantes escribir en ubicaciones arbitrarias fuera de la carpeta de destino designada"}], "id": "CVE-2021-23772", "lastModified": "2026-06-17T03:38:52.827", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "report@snyk.io", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-24T12:15:07.697", "references": [{"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08"}, {"source": "report@snyk.io", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169"}, {"source": "report@snyk.io", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/kataras/iris/commit/e213dba0d32ff66653e0ef124bc5088817264b08"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kataras/iris: unsafe handling of file names during upload using UploadFormFiles method may allow attackers to write to arbitrary locations outside the designated target folder", "id": "2036051", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2036051"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-59", "details": ["This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.", "A flaw was found in the Iris Web Framework, where the UploadFormFiles method unsafely handles file names during upload. This flaw allows an attacker to write in arbitrary locations outside the designated target folder."], "name": "CVE-2021-23772", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/acm-grafana-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2021-12-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-23772\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-23772\nhttps://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRIS-2325169\nhttps://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKATARASIRISV12-2325170"], "threat_severity": "Moderate"}

{}