GO-2022-1031

Open redirect in github.com/labstack/echo/v4

At a glance

Published: 2022-10-11 21:29 UTC
Updated: 2024-05-20 16:03 UTC
CVE: CVE-2022-40083
Aliases: GHSA-crxj-hrmp-4rwf

Description

Labstack Echo contains an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).

Affected packages

Package	Versions
Go · github.com/labstack/echo/v4	introduced 0, fixed 4.9.0

References

https://github.com/labstack/echo/issues/2259 REPORT
https://github.com/labstack/echo/pull/2260 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database