CVE-2022-26945

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://discuss.hashicorp.com	Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930	Mitigation Vendor Advisory
https://discuss.hashicorp.com	Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hashicorp:go-getter::::::::
	cpe:2.3:a:hashicorp:go-getter:2.0.2:::::::*

History

21 Nov 2024, 06:54

Type	Values Removed	Values Added
References	~~() https://discuss.hashicorp.com - Vendor Advisory~~	() https://discuss.hashicorp.com - Vendor Advisory
References	~~() https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 - Mitigation, Vendor Advisory~~	() https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 - Mitigation, Vendor Advisory

08 Aug 2023, 14:21

Type	Values Removed	Values Added
CWE	~~CWE-77~~	NVD-CWE-noinfo

Information

Published : 2022-05-25 12:15

Updated : 2024-11-21 06:54

NVD link : CVE-2022-26945

Mitre link : CVE-2022-26945

CVE.ORG link : CVE-2022-26945

JSON object : View

Products Affected

hashicorp

go-getter

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-26945", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-05-25T12:15:08.153", "references": [{"url": "https://discuss.hashicorp.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930", "tags": ["Mitigation", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://discuss.hashicorp.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0."}, {"lang": "es", "value": "go-getter hasta 1.5.11 y 2.0.2 permit\u00eda el cambio de protocolo, la redirecci\u00f3n infinita y la derivaci\u00f3n de la configuraci\u00f3n mediante el abuso del procesamiento de cabeceras de respuesta HTTP personalizadas. Corregido en 1.6.1 y 2.1.0"}], "lastModified": "2024-11-21T06:54:51.053", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "032AE45B-B3DE-478C-B8D6-132C9DB13D2D", "versionEndIncluding": "1.5.11"}, {"criteria": "cpe:2.3:a:hashicorp:go-getter:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDF91522-8B63-4D1F-AD18-7075DC8882A3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}