Search for vulnerabilities
Vulnerability details: VCID-1was-c9fx-aaaj
Vulnerability ID VCID-1was-c9fx-aaaj
Aliases CVE-2020-28851
Summary In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-129 Improper Validation of Array Index
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2021:1168
rhas Important https://access.redhat.com/errata/RHSA-2021:3016
rhas Moderate https://access.redhat.com/errata/RHSA-2022:0577
rhas Important https://access.redhat.com/errata/RHSA-2022:1276
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28851.json
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2020-28851
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1913333
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2020-28851
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-28851
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-28851
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28851.json
https://api.first.org/data/v1/epss?cve=CVE-2020-28851
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28851
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/golang/go/issues/42535
https://security.netapp.com/advisory/ntap-20210212-0004/
1913333 https://bugzilla.redhat.com/show_bug.cgi?id=1913333
980001 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980001
cpe:2.3:a:golang:go:1.15.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:go:1.15.4:*:*:*:*:*:*:*
CVE-2020-28851 https://nvd.nist.gov/vuln/detail/CVE-2020-28851
RHSA-2021:1168 https://access.redhat.com/errata/RHSA-2021:1168
RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016
RHSA-2022:0577 https://access.redhat.com/errata/RHSA-2022:0577
RHSA-2022:1276 https://access.redhat.com/errata/RHSA-2022:1276
RHSA-2022:1762 https://access.redhat.com/errata/RHSA-2022:1762
RHSA-2022:7129 https://access.redhat.com/errata/RHSA-2022:7129
RHSA-2022:7954 https://access.redhat.com/errata/RHSA-2022:7954
USN-5873-1 https://usn.ubuntu.com/5873-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28851.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2020-28851
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-28851
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-28851
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.21187
EPSS Score 0.00082
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.