-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cloudflare/cloudflared | go | < 0.0.0-20230313153246-f686da832f85 | 0.0.0-20230313153246-f686da832f85 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from the installer's directory configuration logic in the WiX file (cloudflared.wxs), not from specific code functions. The issue was caused by conditional logic that incorrectly selected ProgramFiles64Folder for 32-bit Windows systems, leading to installation in a world-writable directory. The patch corrected this by defaulting to ProgramFilesFolder for non-x64 architectures. Since the vulnerability resides in installer configuration (XML conditional statements) rather than traditional code functions, no specific vulnerable functions in the codebase are identified. The CWE-59 exploitation occurs at the installer's file handling level, not within programmatic functions.
Ongoing coverage of React2Shell