Detections
Analytics
Golang: stdlib: security update to 1.20.11stdlib: security update to 1.20.12stdlib: security update to 1.21.4stdlib: security update to 1.21.5
high Tenable Cloud Security Plugin ID 428501
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning
with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix
may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to
the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root
local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a
seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert
this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute,
and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4
inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in
filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has
been restored. (CVE-2023-45283)
See Also
Plugin Details
Severity: High
ID: 428501
Version: Revision 1.4
Type: Local
Family: Golang
Published: 7/21/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2023-45283
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/8/2023
Vulnerability Publication Date: 11/8/2023
Reference Information
CVE: CVE-2023-45283