Vulnerability DatabaseCVE-2021-4236
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2021-4236
December 27, 2022
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
Affected Packages
github.com/ecnepsnai/web (GO):
Affected version(s) >=v1.4.0 <v1.5.2
Fix Suggestion:
Update to version v1.5.2
Related Resources (5)
https://github.com/ecnepsnai/web/security/advisories/GHSA-5gjg-jgh4-gppm
https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f
https://github.com/ecnepsnai/web
https://nvd.nist.gov/vuln/detail/CVE-2021-4236
https://pkg.go.dev/vuln/GO-2021-0107
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Missing Critical Step in Authentication
CWE-304
Uncontrolled Resource Consumption
CWE-400
NULL Pointer Dereference
CWE-476
EPSS
Base Score:
0.45