CVE-2020-24553: fedoraproject fedora
Vulnerability summary
CVE-2020-24553 is a medium (CVSS 6.1) vulnerability in fedoraproject fedora. EPSS estimates a 3.65% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 3 public exploits are recorded.
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 02-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
3.65%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.65% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (redteam-pentesting.de)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu6 products
- golang-1.10All versions (No fix recorded) | < 1.10.4-2ubuntu1~16.04.2 | < 1.10.4-2ubuntu1~18.04.2
- golang-1.13All versions (No fix recorded)
- golang-1.14< 1.14.3-2ubuntu2~20.04.2
- golang-1.6All versions (No fix recorded)
- golang-1.8All versions (No fix recorded)
Suse4 products
- go1.14&distro=SUSE Linux Enterprise Module for Development Tools 15 SP1< 1.14.9-1.18.1
- go1.14&distro=SUSE Linux Enterprise Module for Development Tools 15 SP2< 1.14.9-1.18.1
- go1.15&distro=SUSE Linux Enterprise Module for Development Tools 15 SP1< 1.15.2-1.3.1
- go1.15&distro=SUSE Linux Enterprise Module for Development Tools 15 SP2< 1.15.2-1.3.1
Opensuse3 products
- leapEOL15.1 | 15.2
- go1.14&distro=openSUSE Leap 15.1< 1.14.9-lp151.16.1
- go1.14&distro=openSUSE Leap 15.2< 1.14.9-lp152.2.6.1
Alpine1 product
- go≥ 1.15.0, < 1.15.2-r0
Debian1 product
- golang-1.15< 1.15.2-1
Fedoraproject1 product
- fedoraEOL33
Go1 product
- stdlib≥ 1.15.0-0, < 1.15.1
Golang1 product
- go< 1.14.8 | ≥ 1.15.0, < 1.15.1
Mageia1 product
- golang< 1.13.15-2.mga7
Oracle1 product
10 vendors · 20 products
References
35 links- seclists.org/fulldisclosure/2020/Sep/5Mailing ListX Refsource FULLDISCREPORTExploitThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- groups.google.com/forum/X Refsource MISC
- packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.htmlX Refsource MISCREPORTExploitThird Party AdvisoryVDB Entry
Show all 35 references
- groups.google.com/forum/REPORT
- go.dev/issue/40928REPORT
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
