x/vulndb: potential Go vuln in github.com/b3log/wide: GHSA-6452-jr93-r5qm

[GoVulnBot]

In GitHub Security Advisory GHSA-6452-jr93-r5qm, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/b3log/wide	1.6.0	< 1.6.0

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/b3log/wide
      versions:
        - fixed: 1.6.0
      packages:
        - package: github.com/b3log/wide
summary: b3log Wide unauthenticated file access
description: |-
    b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files.
    First, the attacker can write code in the editor, and compile and run it
    approximately three times to read an arbitrary file. Second, the attacker can
    create a symlink, and then place the symlink into a ZIP archive. An unzip
    operation leads to read access, and write access (depending on file
    permissions), to the symlink target. Third, the attacker can import a Git
    repository that contains a symlink, similarly leading to read and write access.
cves:
    - CVE-2019-13915
ghsas:
    - GHSA-6452-jr93-r5qm
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-13915
    - report: https://github.com/b3log/wide/issues/355
    - web: https://sca.analysiscenter.veracode.com/vulnerability-database/security/arbitrary-file-reads-and-writes/go/sid-20862
    - web: https://web.archive.org/web/20190522035724/https://github.com/b3log/wide
    - advisory: https://github.com/advisories/GHSA-6452-jr93-r5qm

[neild]

Module has been deleted from GitHub. Appears to be a binary, so effectively private anyway.

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)