Skip to content
Fencer Vulns
medium 6.1

CVE-2020-24553 json

Cross-site scripting in net/http/cgi and net/http/fcgi

published 2020-09-02 6 y ago modified 2026-09-08 2 mo ago also BIT-golang-2020-24553 , EUVD-2020-17273 , GO-2021-0226

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.6%
EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Patch / fix

  • bitnami golang 1.14.8, 1.15.1
  • go stdlib 1.14.8, 1.15.1
  • golang go 1.14.8, 1.15.1
  • golang-1.15 Debian 11 1.15.2-1

debian advisories DEBIAN-CVE-2020-24553

  • golang-1.10 Ubuntu 16.04 LTS 1.10.4-2ubuntu1~16.04.2
  • golang-1.10 Ubuntu 18.04 LTS 1.10.4-2ubuntu1~18.04.2
  • golang-1.14 Ubuntu 20.04 LTS 1.14.3-2ubuntu2~20.04.2

ubuntu advisories UBUNTU-CVE-2020-24553

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • delve RHEL 8 1.4.1-1.module+el8.3.0+7840+63dfb1ed
  • golang RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • go-toolset RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-bin RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-src RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-misc RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-race RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc
  • golang-tests RHEL 8 1.14.12-1.module+el8.3.0+8784+380394dc

red hat advisories RHSA-2020:5493RHSA-2021:0145

  • go1.15 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.15.2-1.3.1
  • go1.14 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.14.9-1.18.1

suse advisories SUSE-SU-2020:2776-1SUSE-SU-2020:2761-1

  • go1.14 openSUSE Tumbleweed 1.14.15-1.6
  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.14 openSUSE Leap 15.2 1.14.9-lp152.2.6.1
  • go1.14 openSUSE Leap 15.1 1.14.9-lp151.16.1

opensuse advisories openSUSE-SU-2024:10807-1openSUSE-SU-2024:10808-1openSUSE-SU-2020:1587-1openSUSE-SU-2020:1584-1

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.15.2-r0

alpine advisories ALPINE-CVE-2020-24553

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 1.15.1-1

arch linux advisories AVG-1215

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-24553 updated cvss 6.1

golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS

  • Red Hat OpenShift Serverless cli
    affected: no fix available
  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, golang, libgcc, +20 more
    affected: no fix planned “Out of support scope”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix available “Fix deferred”
  • Red Hat Openshift Serverless 1.12 openshift-serverless-1/client-kn-rhel8 0.18.4-2, openshift-serverless-1/serving-queue-rhel8 0.18.2-3, openshift-serverless-1/eventing-mtping-rhel8 0.18.6-2, openshift-serverless-1/kourier-control-rhel8 0.18.0-2, openshift-serverless-1/serving-webhook-rhel8 0.18.2-3, openshift-serverless-1/eventing-webhook-rhel8 0.18.6-2, +20 more
    fixed: vendor fix RHSA-2021:0146
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.4.1-1.module+el8.3.0+7840+63dfb1ed, golang 1.14.12-1.module+el8.3.0+8784+380394dc, go-toolset 1.14.12-1.module+el8.3.0+8784+380394dc, golang-bin 1.14.12-1.module+el8.3.0+8784+380394dc, golang-src 1.14.12-1.module+el8.3.0+8784+380394dc, golang-misc 1.14.12-1.module+el8.3.0+8784+380394dc, +2 more
    fixed: vendor fix RHSA-2020:5493
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.18.4-2.el8
    fixed: vendor fix RHSA-2021:0145
show 1 more
  • Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-all-in-one-rhel7 Red Hat OpenShift Service Mesh 1 ior, kiali, servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, +11 more Red Hat Ceph Storage 2 grafana Red Hat Ceph Storage 3 grafana, prometheus-node-exporter Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat OpenShift Container Platform 3.11 apb, cri-o, podman, cockpit, heapster, cri-tools, +59 more
    +5 more products
    Red Hat OpenShift Container Platform 4 apb, faq, runc, cri-o, pivot, podman, +35 more Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator Red Hat OpenShift Virtualization 1 virt-api, ember-csi, sriov-cni, multus-cni, kubevirt-cdi, virt-handler, +19 more Red Hat OpenShift Virtualization 2 virt-api, kubemacpool, virt-handler, bridge-marker, virt-launcher, virt-operator, +27 more Red Hat Storage 3 etcd, heketi, grafana, heketi-client, python-heketi, noobaa-operator-container, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.65% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • seclists.org http://seclists.org/fulldisclosure/2020/Sep/5 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html referenced PoC, tagged "exploit" by a source, unverified
  • redteam-pentesting.de https://www.redteam-pentesting.de/advisories/rt-sa-2020-004 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.14.8
>=1.15.0, <1.15.1
1.14.8
1.15.1
go stdlib
<1.14.8
>=1.15.0-0, <1.15.1
1.14.8
1.15.1

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.