CVE-2021-4236
Critical
Description
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWeb
PublishedDec 27, 2022
First seenDec 27, 2022
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- web_project web1.5.2 or later
- github.com/ecnepsnai/web1.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| web_project web | 1.4.0 ≤ v < 1.5.2 | 1.5.2 |
| github.com/ecnepsnai/webGo | 1.4.0 ≤ v < 1.5.2 | 1.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.