CVE-2021-33359

HIGH

gowitness < 2.3.6 - Unauthenticated Arbitrary File Read via URL Parameter

Title source: llm
STIX 2.1

Description

A vulnerability exists in gowitness < 2.3.6 that allows an unauthenticated attacker to perform an arbitrary file read using the file:// scheme in the url parameter to get an image of any file.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://twitter.com/leonjza/status/1395283512433971202?s=19
Patch, Release Notes, Third Party Advisory x_refsource_misc
https://github.com/sensepost/gowitness/releases/tag/2.3.6

Scores

CVSS v3 7.5
EPSS 0.0125
EPSS Percentile 65.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-552
Status published
Products (1)
sensepost/gowitness < 2.3.6
Published Jun 09, 2021
Tracked Since Feb 18, 2026