CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

• CWE-436

• https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQRelease Notes, Vendor Advisory
• https://security.gentoo.org/glsa/202208-02Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220225-0006/Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
• https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQRelease Notes, Vendor Advisory
• https://security.gentoo.org/glsa/202208-02Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220225-0006/Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory

Published

Feb 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23768This Vulnerability in NIS-HAP11AC is caused by an exposed ex…9.8
• CVE-2022-23769Remote code execution vulnerability due to insufficient user…9.8
• CVE-2022-2377The Directorist WordPress plugin before 7.3.0 does not have …4.3
• CVE-2022-23770This vulnerability could allow a remote attacker to execute …9.8
• CVE-2022-23771This vulnerability occurs in user accounts creation and dele…8.8
• CVE-2022-23772Rat.SetString in math/big in Go before 1.16.14 and 1.17.x be…7.5
• CVE-2022-23774Docker Desktop before 4.4.4 on Windows allows attackers to m…5.3
• CVE-2022-23775TrueStack Direct Connect 1.4.7 has Incorrect Access Control.9.8
• CVE-2022-23779Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes…5.3
• CVE-2022-2378The Easy Student Results WordPress plugin through 2.2.8 does…6.1
• CVE-2022-2379The Easy Student Results WordPress plugin through 2.2.8 lack…7.5
• CVE-2022-23790Improper Neutralization of Input During Web Page Generation …6.1