CVE-2023-45285

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-452865.9A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Poo CVE-2023-452877.5Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent t CVE-2023-452887.5An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Mai CVE-2023-452894.3When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not for CVE-2023-452906.5When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue CVE-2023-452925.3When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a n CVE-2023-45309.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel CVE-2023-453038.8ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker sup CVE-2023-45319.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software al CVE-2023-453119.8fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute ar CVE-2023-453128.8In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secur CVE-2023-453155.5Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enabl