CVE-2019-18923
MEDIUMgo-camo < 2.1.1 - Cross-Site Scripting via Insufficient Content Type Validation
Title source: llmDescription
Insufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arbitrary content from go-camo's origin.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/cactus/go-camo/blob/505862f7bf14c8b6ff945734d5f3fdcd929e45dd/pkg/camo/proxy.go#L453-L460
Exploit, Third Party Advisory x_refsource_confirm
https://github.com/cactus/go-camo/security/advisories/GHSA-jg2r-qf99-4wvr
Scores
CVSS v3
6.1
EPSS
0.0086
EPSS Percentile
53.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
go-camo_project/go-camo
< 2.1.1
Published
Nov 13, 2019
Tracked Since
Feb 18, 2026