Go CGI / FastCGI Transport Cross Site Scripting
Posted by deepcore on September 3, 2020 – 8:23 am
The CGI and FastCGI implementations in the Go standard library behave differently from the HTTP server implementation when serving content. In contrast to the documented behavior, they may return non-HTML data as HTML. This may lead to cross site scripting vulnerabilities even if uploaded data has been validated during upload. Versions 1.15 and 1.14.7 and below are affected.
Post a reply
You must be logged in to post a comment.