Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Gin Framework Default Logger Allows Remote Log Injection

CVE-2020-36567 · published 3 years ago
Summary

The default logger in Gin Framework versions before 1.6.0 can be tricked into logging arbitrary messages from the internet. This could allow an attacker to hide malicious activity or make it harder to detect security issues. Update to a version of Gin Framework 1.6.0 or later to fix this issue.

What to do
  • Update github.com gin-gonic to version 1.6.0.
  • Update gin-gonic gin to version 1.6.0 or later.
Affected software
Ecosystem VendorProductAffected versions
go github.com gin-gonic < 1.6.0
Fix: upgrade to 1.6.0
– gin-gonic gin < 1.6.0
cpe:2.3:a:gin-gonic:gin:*:*:*:*:*:*:*:*
Original advisory text
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-116Improper Encoding or Escaping of Output
CWE-117Improper Output Neutralization for Logs
Timeline
Published27 Dec 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-6vm3-jj99-7229 · GHSA
CVE-2020-36567 · NVD
Track software like this
Free during beta