{"id":"CVE-2022-31259","aliases":["EUVD-2022-5053","GHSA-qx32-f6g6-fcfr","GO-2022-0463"],"status":"published","title":"Access control bypass in beego","description":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.22158,"percentile":0.97692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2022-05-21T00:00:00Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"Go","package":"github.com/beego/beego/v2","fixed_in":["2.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/beego/beego","fixed_in":["1.12.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/beego/beego/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/beego/beego","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/beego/beego/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/beego/beego","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/astaxie/beego","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/beego/beego","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/beego/beego/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]}],"products":[{"vendor":"beego","product":"beego"}],"references":[{"url":"https://github.com/beego/beego/issues/4946","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://beego.vip","tags":["x_transferred","Product","web"]},{"url":"https://github.com/beego/beego/tree/v2.0.2","tags":["x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/advisories/GHSA-qx32-f6g6-fcfr","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31259","tags":["advisory"]},{"url":"https://github.com/beego/beego/pull/4958","tags":["web","fix"]},{"url":"https://github.com/beego/beego/pull/4954","tags":["web"]},{"url":"https://github.com/beego/beego/commit/228576173a236c81a2122923fcf8099ad294e009","tags":["web"]},{"url":"https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0463","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31259.json","tags":["advisory"]},{"url":"https://github.com/beego/beego","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31259","description":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","status":"published","published":"2022-05-21T00:00:00Z","modified":"2024-08-03T07:11:39.91Z","updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-5053","description":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","status":"published","published":"2022-05-21T00:00:00Z","modified":"2024-08-03T07:11:39Z","updated_at":"2026-11-03T03:25:34.735493Z"}],"ghsa":[{"id":"GHSA-qx32-f6g6-fcfr","title":"Access control bypass in beego","description":"The route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /`p1`/`p2`/`:name` route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","status":"published","published":"2022-05-22T00:00:32Z","modified":"2023-08-29T17:55:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2022-31259","description":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","status":"published","published":"2022-05-21T19:15:52.99Z","modified":"2026-06-17T04:45:14.687Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"GHSA-qx32-f6g6-fcfr","title":"Access control bypass in beego","description":"The route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /`p1`/`p2`/`:name` route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","status":"published","published":"2022-05-22T00:00:32Z","modified":"2026-07-08T06:27:50.220219676Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"CVE-2022-31259","description":"The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).","status":"published","published":"2022-05-21T00:00:00Z","modified":"2026-10-28T02:30:53.508194887Z","updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GO-2022-0463","title":"Access control bypass due to broad route matching in github.com/beego/beego and beego/v2","description":"Routes in the beego HTTP router can match unintended patterns. This overly-broad matching may permit an attacker to bypass access controls.\n\nFor example, the pattern \"/a/b/:name\" can match the URL \"/a.xml/b/\". This may bypass access control applied to the prefix \"/a/\".","status":"published","published":"2022-07-01T20:06:59Z","modified":"2024-06-03T20:51:31Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}