CVE-2018-12976
moderate-risk
Published 2018-07-05
In Go Doc Dot Org (gddo) through 2018-06-27, an attacker could use specially crafted <go-import> tags in packages being fetched by gddo to cause a directory traversal and remote code execution.
Do I need to act?
~
2.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: daffe1f90ec57f8ed69464f9094753fc6452e983, daffe1f90ec57f8ed69464f9094753fc6452e983
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (1)
Go Doc Dot Org
Affected Vendors
References (4)
43
/ 100
moderate-risk
Severity
32/34 · Critical
Exploitability
6/34 · Minimal
Exposure
5/34 · Minimal