Back to Database
Status published
Medium
CVE-2020-24553
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because...
Vulnerability Description
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-24553
Credits & Attribution
No credits recorded in the NVD database.
References
- http://seclists.org/fulldisclosure/2020/Sep/5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs
- http://seclists.org/fulldisclosure/2020/Sep/5
- http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html
- https://security.netapp.com/advisory/ntap-20200924-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.redteam-pentesting.de/advisories/rt-sa-2020-004
More from golang
View All →CVE-2022-29526
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege...
Medium
5.3
CVE-2022-28327
The generic P-256 feature in crypto/elliptic in Go before 1.17.9...
High
7.5
CVE-2022-27664
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1,...
High
7.5
CVE-2022-27536
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be...
High
7.5
CVE-2022-27191
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker...
High
7.5
Affected Vendor
golang
View all reports →Affected Software
go, fedora, leap, communications cloud native core policy
Vulnerable Versions:
0, 1.15.0, 33, 15.1, 15.2, 1.5.0
Timeline
Official Publish:
September 2nd, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.