Log in Start free

Vulnerability · Published Sep 28, 2022 · Assigned by mitre

CVE-2022-40083

Critical 9.6

In plain English

A critical-severity open redirect in the golang-github-labstack-echo package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)3.2%top 11.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei

Official description

Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-labstack-echono fix listedDEBIAN-CVE-2022-40083
Debian:13golang-github-labstack-echo4.11.1-1DEBIAN-CVE-2022-40083
Debian:14golang-github-labstack-echo4.11.1-1DEBIAN-CVE-2022-40083
Gogithub.com/labstack/echo/v44.9.0GHSA-crxj-hrmp-4rwf
Gogithub.com/labstack/echo/v44.9.0GO-2022-1031
Ubuntu:22.04:LTSgolang-github-labstack-echono fix listedUBUNTU-CVE-2022-40083
Ubuntu:24.04:LTSgolang-github-labstack-echono fix listedUBUNTU-CVE-2022-40083
Ubuntu:25.10golang-github-labstack-echono fix listedUBUNTU-CVE-2022-40083
Ubuntu:26.04:LTSgolang-github-labstack-echono fix listedUBUNTU-CVE-2022-40083
Ubuntu:26.10golang-github-labstack-echono fix listedUBUNTU-CVE-2022-40083
Ubuntu:22.04:LTSgolang-github-labstack-echo.v2no fix listedUBUNTU-CVE-2022-40083
Ubuntu:22.04:LTSgolang-github-labstack-echo.v3no fix listedUBUNTU-CVE-2022-40083
Ubuntu:22.04:LTSgolang-github-labstack-gommonno fix listedUBUNTU-CVE-2022-40083
Ubuntu:24.04:LTSgolang-github-labstack-gommonno fix listedUBUNTU-CVE-2022-40083
Ubuntu:25.10golang-github-labstack-gommonno fix listedUBUNTU-CVE-2022-40083
Ubuntu:26.04:LTSgolang-github-labstack-gommonno fix listedUBUNTU-CVE-2022-40083
Ubuntu:26.10golang-github-labstack-gommonno fix listedUBUNTU-CVE-2022-40083

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References