Advisory CVE-2024-38513 references a vulnerability in the following Go modules:
Description:
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in ve...
References:
Cross references:
See doc/triage.md for instructions on how to triage this report.
id: GO-ID-PENDING
modules:
- module: github.com/gofiber/fiber
vulnerable_at: 1.14.6
summary: CVE-2024-38513 in github.com/gofiber/fiber
cves:
- CVE-2024-38513
references:
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-38513
- fix: https://github.com/gofiber/fiber/commit/66a881441b27322a331f1b526cf1eb6b3358a4d8
- web: https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v
source:
id: CVE-2024-38513
created: 2024-07-01T20:01:21.599133783Z
review_status: UNREVIEWED
Advisory CVE-2024-38513 references a vulnerability in the following Go modules:
Description:
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in ve...
References:
Cross references:
See doc/triage.md for instructions on how to triage this report.