x/vulndb: potential Go vuln in github.com/beego/beego/v2: GHSA-wr3p-r5fj-wf97

[GoVulnBot]

Advisory GHSA-wr3p-r5fj-wf97 references a vulnerability in the following Go modules:

Module
github.com/beego/beego
github.com/beego/beego/v2

Description:
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in the file.go file.

References:

• ADVISORY: GHSA-wr3p-r5fj-wf97
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-40465
• FIX: beego/beego@5a366cd
• FIX: beego/beego@8f89e12
• WEB: https://gist.github.com/nyxfqq/a5a2fc5147a1b34538e1ac05a3e56910
• WEB: GHSA-6g9p-wv47-4fxq

Cross references:

• github.com/beego/beego appears in 5 other report(s):
  • data/excluded/GO-2022-0575.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-2v6v-q994-xvxx #575) NOT_A_VULNERABILITY
  • data/excluded/GO-2022-0598.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-ffjp-66mx-3qpj #598) NOT_A_VULNERABILITY
  • data/reports/GO-2022-0463.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: CVE-2022-31259 #463)
  • data/reports/GO-2022-0569.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-95f9-94vc-665h #569)
  • data/reports/GO-2022-0572.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-28r6-jm5h-mrgg #572)
• github.com/beego/beego/v2 appears in 4 other report(s):
  • data/excluded/GO-2022-0935.yaml (x/vulndb: potential Go vuln in github.com/beego/beego/v2: CVE-2021-39391, GHSA-c77f-4rgj-jfr4 #935) NOT_IMPORTABLE
  • data/reports/GO-2022-0463.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: CVE-2022-31259 #463)
  • data/reports/GO-2022-0569.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-95f9-94vc-665h #569)
  • data/reports/GO-2022-0572.yaml (x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-28r6-jm5h-mrgg #572)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/beego/beego
      vulnerable_at: 1.12.12
    - module: github.com/beego/beego/v2
      versions:
        - fixed: 2.2.1
      vulnerable_at: 2.2.0
summary: Beego privilege escalation vulnerability in github.com/beego/beego
cves:
    - CVE-2024-40465
ghsas:
    - GHSA-wr3p-r5fj-wf97
references:
    - advisory: https://github.com/advisories/GHSA-wr3p-r5fj-wf97
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-40465
    - fix: https://github.com/beego/beego/commit/5a366cd62b555354a917a2d153e6563fe4d6eb88
    - fix: https://github.com/beego/beego/commit/8f89e12e6cafb106d5c201dbc3b2a338bfde74e2
    - web: https://gist.github.com/nyxfqq/a5a2fc5147a1b34538e1ac05a3e56910
    - web: https://github.com/beego/beego/security/advisories/GHSA-6g9p-wv47-4fxq
source:
    id: GHSA-wr3p-r5fj-wf97
    created: 2024-08-01T14:01:19.115251896Z
review_status: UNREVIEWED

[tatianab]

Based on beego/beego#5694, it appears the maintainer does not believe this to be a vulnerability. So excluding as NOT_A_VULNERABILITY.

[gopherbot]

Change https://go.dev/cl/607820 mentions this issue: data/excluded: add 3 reports