CVE-2019-18923

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-13 · updated 2026-06-17
Weakness: CWE-79

Description

Insufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arbitrary content from go-camo's origin.

Affected products

Go-Camo Project Go-Camo: before 2.1.1 — fixed in 2.1.1

How to fix

Upgrade to a fixed version: Go-Camo Project Go-Camo 2.1.1. Check the vendor advisory for mitigations.

References

https://github.com/cactus/go-camo/blob/505862f7bf14c8b6ff945734d5f3fdcd929e45dd/pkg/camo/proxy.go#L453-L460
https://github.com/cactus/go-camo/security/advisories/GHSA-jg2r-qf99-4wvr
https://github.com/cactus/go-camo/blob/505862f7bf14c8b6ff945734d5f3fdcd929e45dd/pkg/camo/proxy.go#L453-L460
https://github.com/cactus/go-camo/security/advisories/GHSA-jg2r-qf99-4wvr

Get alerted when CVE-2019-18923 or the next vulnerability affects your stack