CVE-2020-36565: Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36565?
CVE-2020-36565 is rated as a medium severity vulnerability due to its potential for allowing directory traversal attacks.
How do I fix CVE-2020-36565?
To fix CVE-2020-36565, update the Labstack Echo framework to version 4.2.0 or later where the vulnerability has been addressed.
What systems are affected by CVE-2020-36565?
CVE-2020-36565 affects Labstack Echo versions prior to 4.2.0 running on Windows systems.
What is the impact of CVE-2020-36565?
The impact of CVE-2020-36565 is that an attacker could exploit the directory traversal vulnerability to read sensitive files outside the intended directory.
Is CVE-2020-36565 specific to any software?
Yes, CVE-2020-36565 is specifically related to the Labstack Echo web framework on Windows.