CVE-2019-16354: Incorrect permissions for critical resource in github.com/astaxie/beego
Summary
CVE-2019-16354: Incorrect permissions for critical resource in github.com/astaxie/beego. Affects github.com/astaxie/beego versions < 1.12.2. Fixed in 1.12.2. How to fix ↓
Also tracked for
- github.com/beego/beego · Go
- github.com/beego/beego · Go
The same CVE-2019-16354 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/astaxie/beego is a Go package that provides a web framework for building web applications. It offers various features and functionalities to simplify the development process. However, a vulnerability has been identified in the package that affects the way session data is stored. This vulnerability allows local users with filesystem access to read arbitrary data due to incorrect permissions set for the critical resource.
Vulnerability Detail
The vulnerability in github.com/astaxie/beego arises from the permissive permissions set for session data storage. As a result, local users with filesystem access can exploit this flaw to read arbitrary data. This can lead to unauthorized access to sensitive information, potentially compromising the security and privacy of the application and its users. The vulnerability has been assigned the identifier CVE-2019-16354 and is also tracked as GHSA-f6px-w8rh-7r89.
How To Fix
Latest published version: v1.12.3 as of 23 Oct 2026
go get github.com/astaxie/beego@v1.12.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.2
This is the first release that contains the fix.
go get github.com/astaxie/beego@v1.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to update the package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the vulnerability in github.com/astaxie/beego allows local users with filesystem access to read arbitrary data due to incorrect permissions set for the critical resource. It is crucial to update the package to the fixed version to mitigate the risk of unauthorized access to sensitive information. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/astaxie/beego →
FAQ
The vulnerability allows local users with filesystem access to read arbitrary data, potentially leading to unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses Gopkg.lock to monitor and alert in real-time for open-source vulnerabilities in software.
There is no known exploit available for this vulnerability at the moment. However, it is crucial to update the package to the fixed version to mitigate the risk.
There may be alternative packages or libraries available that provide similar functionality. It is recommended to research and evaluate alternative options based on your specific requirements and project constraints.
You can find more information about this vulnerability in the Open Source Vulnerability database at https://pkg.go.dev/vuln/GO-2021-0084.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/astaxie/beego.
