Vulnerabilities in pkg:golang/github.com/emicklei/go-restful

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r48q-9g5r-8q2h",
  "modified" : "2022-06-17T18:18:04Z",
  "published" : "2022-06-09T00:00:23Z",
  "aliases" : [ "CVE-2022-1996" ],
  "summary" : "Authorization Bypass Through User-Controlled Key in go-restful",
  "details" : "Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/emicklei/go-restful/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.8.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/emicklei/go-restful"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.16.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/emicklei/go-restful/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "2.7.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-1996"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/emicklei/go-restful/issues/489"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/emicklei/go-restful/commit/926662532deb450272956c7bc573978464aae74e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20220923-0005"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2022-0619"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3"
  }, {
    "type" : "WEB",
    "url" : "https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/emicklei/go-restful"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-06-09T23:50:21Z",
    "nvd_published_at" : "2022-06-08T13:15:00Z"
  }
}