Search for vulnerabilities
Vulnerability details: VCID-az6z-f5h4-aaap
Vulnerability ID VCID-az6z-f5h4-aaap
Aliases CVE-2022-30321
GHSA-fcgg-rvwg-jv58
Summary CVE-2022-30321 go-getter: unsafe download (issue 1 of 3)
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-229 Improper Handling of Values
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2022:5069
rhas Important https://access.redhat.com/errata/RHSA-2022:5673
cvssv3 8.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30321.json
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00143 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00143 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00143 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00143 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00685 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00829 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00829 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00829 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00829 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00829 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
epss 0.05329 https://api.first.org/data/v1/epss?cve=CVE-2022-30321
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=2092918
cvssv3.1 6.5 https://discuss.hashicorp.com
generic_textual MODERATE https://discuss.hashicorp.com
cvssv3.1 8.6 https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
generic_textual HIGH https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
cvssv3.1 8.4 https://github.com/hashicorp/go-getter
generic_textual HIGH https://github.com/hashicorp/go-getter
cvssv3.1 8.6 https://github.com/hashicorp/go-getter/commit/38e97387488f5439616be60874979433a12edb48
generic_textual HIGH https://github.com/hashicorp/go-getter/commit/38e97387488f5439616be60874979433a12edb48
cvssv3.1 8.6 https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
generic_textual HIGH https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
cvssv3.1 8.6 https://github.com/hashicorp/go-getter/pull/359
generic_textual HIGH https://github.com/hashicorp/go-getter/pull/359
cvssv3.1 8.6 https://github.com/hashicorp/go-getter/pull/361
generic_textual HIGH https://github.com/hashicorp/go-getter/pull/361
cvssv3.1 8.6 https://github.com/hashicorp/go-getter/releases
generic_textual HIGH https://github.com/hashicorp/go-getter/releases
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-30321
cvssv3 8.6 https://nvd.nist.gov/vuln/detail/CVE-2022-30321
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2022-30321
cvssv3.1 8.6 https://pkg.go.dev/vuln/GO-2022-0586
generic_textual HIGH https://pkg.go.dev/vuln/GO-2022-0586
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30321.json
https://api.first.org/data/v1/epss?cve=CVE-2022-30321
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30321
https://discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
https://github.com/hashicorp/go-getter
https://github.com/hashicorp/go-getter/commit/38e97387488f5439616be60874979433a12edb48
https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
https://github.com/hashicorp/go-getter/pull/359
https://github.com/hashicorp/go-getter/pull/361
https://github.com/hashicorp/go-getter/releases
https://pkg.go.dev/vuln/GO-2022-0586
1011741 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011741
2092918 https://bugzilla.redhat.com/show_bug.cgi?id=2092918
cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:*
cpe:2.3:a:hashicorp:go-getter:2.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:hashicorp:go-getter:2.0.2:*:*:*:*:*:*:*
CVE-2022-30321 https://nvd.nist.gov/vuln/detail/CVE-2022-30321
RHSA-2022:5069 https://access.redhat.com/errata/RHSA-2022:5069
RHSA-2022:5673 https://access.redhat.com/errata/RHSA-2022:5673
RHSA-2022:6133 https://access.redhat.com/errata/RHSA-2022:6133
RHSA-2022:6147 https://access.redhat.com/errata/RHSA-2022:6147
RHSA-2022:6258 https://access.redhat.com/errata/RHSA-2022:6258
RHSA-2022:6308 https://access.redhat.com/errata/RHSA-2022:6308
RHSA-2022:6801 https://access.redhat.com/errata/RHSA-2022:6801
RHSA-2022:6805 https://access.redhat.com/errata/RHSA-2022:6805
RHSA-2022:6905 https://access.redhat.com/errata/RHSA-2022:6905
RHSA-2022:7201 https://access.redhat.com/errata/RHSA-2022:7201
RHSA-2022:7211 https://access.redhat.com/errata/RHSA-2022:7211
RHSA-2022:7216 https://access.redhat.com/errata/RHSA-2022:7216
RHSA-2022:7874 https://access.redhat.com/errata/RHSA-2022:7874
RHSA-2022:9111 https://access.redhat.com/errata/RHSA-2022:9111
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30321.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://discuss.hashicorp.com
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/hashicorp/go-getter
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/hashicorp/go-getter/commit/38e97387488f5439616be60874979433a12edb48
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/hashicorp/go-getter/pull/359
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/hashicorp/go-getter/pull/361
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/hashicorp/go-getter/releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2022-30321
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-30321
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-30321
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://pkg.go.dev/vuln/GO-2022-0586
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.48726
EPSS Score 0.00129
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.