{"id":"CVE-2022-40083","aliases":["DEBIAN-CVE-2022-40083","EUVD-2022-6783","GHSA-crxj-hrmp-4rwf","GO-2022-1031","UBUNTU-CVE-2022-40083"],"status":"published","title":"Labstack Echo Open Redirect vulnerability","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03238,"percentile":0.88376,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2022-09-28T13:34:03Z","modified":"2026-10-28T02:30:42Z","exploits":[{"source":"nuclei","id":"CVE-2022-40083","title":"Labstack Echo 4.8.0 - Open Redirect","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40083.yaml"}],"fixes":[{"ecosystem":"Go","package":"github.com/labstack/echo/v4","fixed_in":["4.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"golang-github-labstack-echo","fixed_in":["4.11.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-labstack-echo","fixed_in":["4.11.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/labstack/echo/v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.1-1","4.11.1-2","4.12.0-1","4.2.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.9.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-labstack-gommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.3-1","0.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-labstack-echo.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-labstack-echo.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-labstack-gommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.6-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-labstack-echo.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-labstack-echo.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.10-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-labstack-gommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.6-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-labstack-gommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.6-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-labstack-gommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-labstack-gommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-labstack-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-labstack-gommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.6-2"]}],"products":[{"vendor":"labstack","product":"echo"}],"references":[{"url":"https://github.com/labstack/echo/issues/2259","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40083","tags":["advisory"]},{"url":"https://github.com/labstack/echo/pull/2260","tags":["web","fix","report"]},{"url":"https://github.com/labstack/echo/releases/tag/v4.9.0","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-1031","tags":["web"]},{"url":"https://github.com/labstack/echo/pull/2260/commits/3154abd1401554fe4d1c09ec550506d8625fc042","tags":["web"]},{"url":"https://github.com/labstack/echo/commit/0ac4d74402391912ff6da733bb09fd4c3980b4e1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-crxj-hrmp-4rwf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40083.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-40083","tags":["advisory"]},{"url":"https://github.com/labstack/echo","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-40083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40083","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-40083","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","status":"published","published":"2022-09-28T13:34:03Z","modified":"2025-05-21T14:40:33.654Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:34:30.493103Z"}],"euvd":[{"id":"EUVD-2022-6783","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","status":"published","published":"2022-09-28T13:34:03Z","modified":"2025-05-21T14:40:33Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:41.46277Z"}],"ghsa":[{"id":"GHSA-crxj-hrmp-4rwf","title":"Labstack Echo Open Redirect vulnerability","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF). Version 4.9.0 contains a patch for the issue.","status":"published","published":"2022-09-29T00:00:26Z","modified":"2023-08-29T21:54:54Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2022-40083","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","status":"published","published":"2022-09-28T14:15:10.953Z","modified":"2026-06-17T05:00:51.44Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:07:29.026521Z"}],"osv":[{"id":"CVE-2022-40083","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","status":"published","published":"2022-09-28T13:34:03Z","modified":"2026-10-28T02:30:42.842197947Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DEBIAN-CVE-2022-40083","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","status":"published","published":"2022-09-28T14:15:10.953Z","modified":"2026-11-03T08:03:05.638091283Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-crxj-hrmp-4rwf","title":"Labstack Echo Open Redirect vulnerability","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF). Version 4.9.0 contains a patch for the issue.","status":"published","published":"2022-09-29T00:00:26Z","modified":"2023-11-08T04:10:22.426797Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"UBUNTU-CVE-2022-40083","description":"Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","status":"published","published":"2022-09-28T14:15:00Z","modified":"2026-10-17T12:55:59.356773219Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"GO-2022-1031","title":"Open redirect in github.com/labstack/echo/v4","description":"Labstack Echo contains an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).","status":"published","published":"2022-10-11T21:29:24Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}