CVE-2024-45258

Summary

CVE-2024-45258 identifies a vulnerability in the req package for Go, specifically versions prior to 3.43.4, where malformed URLs can lead to unintended requests due to improper input validation in the cleanHost function. Affected products include various applications utilizing the req package. The vulnerability poses a critical risk with a CVSS base score of 9.8, indicating high potential impacts on confidentiality, integrity, and availability, along with an exploitability score of 3.9. Organizations are advised to remediate this issue by upgrading to version 3.43.4 or later of the req package to mitigate the risks associated with this vulnerability. The flaw allows exploitation without requiring user interaction or elevated privileges, making it particularly dangerous for networked environments.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.