Vulnerabilites related to gogs - gogs/gogs
cve-2022-0870
Vulnerability from cvelistv5
Published
2022-03-11 10:40
Modified
2024-08-02 23:40
Severity ?
EPSS score ?
Summary
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
References
| ▼ | URL | Tags |
|---|---|---|
| https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531 | x_refsource_CONFIRM | |
| https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.563Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-11T10:40:08",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb"
}
],
"source": {
"advisory": "327797d7-ae41-498f-9bff-cc0bf98cf531",
"discovery": "EXTERNAL"
},
"title": "Server-Side Request Forgery (SSRF) in gogs/gogs",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-0870",
"STATE": "PUBLIC",
"TITLE": "Server-Side Request Forgery (SSRF) in gogs/gogs"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gogs/gogs",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.5"
}
]
}
}
]
},
"vendor_name": "gogs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-918 Server-Side Request Forgery (SSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531"
},
{
"name": "https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb",
"refsource": "MISC",
"url": "https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb"
}
]
},
"source": {
"advisory": "327797d7-ae41-498f-9bff-cc0bf98cf531",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-0870",
"datePublished": "2022-03-11T10:40:09",
"dateReserved": "2022-03-06T00:00:00",
"dateUpdated": "2024-08-02T23:40:04.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-1285
Vulnerability from cvelistv5
Published
2022-06-01 05:55
Modified
2024-08-02 23:55
Severity ?
EPSS score ?
Summary
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.
References
| ▼ | URL | Tags |
|---|---|---|
| https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d | x_refsource_CONFIRM | |
| https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:55:24.665Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-01T05:55:10",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f"
}
],
"source": {
"advisory": "da1fbd6e-7a02-458e-9c2e-6d226c47046d",
"discovery": "EXTERNAL"
},
"title": "Server-Side Request Forgery (SSRF) in gogs/gogs",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1285",
"STATE": "PUBLIC",
"TITLE": "Server-Side Request Forgery (SSRF) in gogs/gogs"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gogs/gogs",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.8"
}
]
}
}
]
},
"vendor_name": "gogs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-918 Server-Side Request Forgery (SSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d"
},
{
"name": "https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f",
"refsource": "MISC",
"url": "https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f"
}
]
},
"source": {
"advisory": "da1fbd6e-7a02-458e-9c2e-6d226c47046d",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1285",
"datePublished": "2022-06-01T05:55:10",
"dateReserved": "2022-04-09T00:00:00",
"dateUpdated": "2024-08-02T23:55:24.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-1986
Vulnerability from cvelistv5
Published
2022-06-09 03:35
Modified
2024-08-03 00:24
Severity ?
EPSS score ?
Summary
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
References
| ▼ | URL | Tags |
|---|---|---|
| https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930 | x_refsource_CONFIRM | |
| https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab6190415032a82 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.142Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab6190415032a82"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.9",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-09T03:35:11",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab6190415032a82"
}
],
"source": {
"advisory": "776e8f29-ff5e-4501-bb9f-0bd335007930",
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in gogs/gogs",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1986",
"STATE": "PUBLIC",
"TITLE": "OS Command Injection in gogs/gogs"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gogs/gogs",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.9"
}
]
}
}
]
},
"vendor_name": "gogs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930"
},
{
"name": "https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab6190415032a82",
"refsource": "MISC",
"url": "https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab6190415032a82"
}
]
},
"source": {
"advisory": "776e8f29-ff5e-4501-bb9f-0bd335007930",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1986",
"datePublished": "2022-06-09T03:35:11",
"dateReserved": "2022-06-03T00:00:00",
"dateUpdated": "2024-08-03T00:24:44.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-0871
Vulnerability from cvelistv5
Published
2022-03-11 00:00
Modified
2024-08-02 23:40
Severity ?
EPSS score ?
Summary
Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.494Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-29T00:00:00",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"url": "https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62"
},
{
"url": "https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78"
}
],
"source": {
"advisory": "ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62",
"discovery": "EXTERNAL"
},
"title": "Missing Authorization in gogs/gogs"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-0871",
"datePublished": "2022-03-11T00:00:00",
"dateReserved": "2022-03-06T00:00:00",
"dateUpdated": "2024-08-02T23:40:04.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-2024
Vulnerability from cvelistv5
Published
2023-02-25 00:00
Modified
2024-08-03 00:24
Severity ?
EPSS score ?
Summary
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.184Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-25T00:00:00",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"url": "https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97"
},
{
"url": "https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41"
}
],
"source": {
"advisory": "18cf9256-23ab-4098-a769-85f8da130f97",
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in gogs/gogs"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-2024",
"datePublished": "2023-02-25T00:00:00",
"dateReserved": "2022-06-08T00:00:00",
"dateUpdated": "2024-08-03T00:24:44.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-1992
Vulnerability from cvelistv5
Published
2022-06-08 13:30
Modified
2024-08-03 00:24
Severity ?
EPSS score ?
Summary
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
References
| ▼ | URL | Tags |
|---|---|---|
| https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab | x_refsource_CONFIRM | |
| https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:43.718Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.9",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Path Traversal in GitHub repository gogs/gogs prior to 0.12.9."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-08T13:30:14",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0"
}
],
"source": {
"advisory": "2e8cdc57-a9cf-46ae-9088-87f09e6c90ab",
"discovery": "EXTERNAL"
},
"title": "Path Traversal in gogs/gogs",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1992",
"STATE": "PUBLIC",
"TITLE": "Path Traversal in gogs/gogs"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gogs/gogs",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.9"
}
]
}
}
]
},
"vendor_name": "gogs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Path Traversal in GitHub repository gogs/gogs prior to 0.12.9."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab"
},
{
"name": "https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0",
"refsource": "MISC",
"url": "https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0"
}
]
},
"source": {
"advisory": "2e8cdc57-a9cf-46ae-9088-87f09e6c90ab",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1992",
"datePublished": "2022-06-08T13:30:14",
"dateReserved": "2022-06-03T00:00:00",
"dateUpdated": "2024-08-03T00:24:43.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-1464
Vulnerability from cvelistv5
Published
2022-05-05 13:45
Modified
2024-08-03 00:03
Severity ?
EPSS score ?
Summary
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .
References
| ▼ | URL | Tags |
|---|---|---|
| https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d | x_refsource_CONFIRM | |
| https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:03:06.270Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.7",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account ."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-05T13:45:12",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850"
}
],
"source": {
"advisory": "34a12146-3a5d-4efc-a0f8-7a3ae04b198d",
"discovery": "EXTERNAL"
},
"title": "Stored xss bug in gogs/gogs",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1464",
"STATE": "PUBLIC",
"TITLE": "Stored xss bug in gogs/gogs"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gogs/gogs",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.7"
}
]
}
}
]
},
"vendor_name": "gogs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account ."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d"
},
{
"name": "https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850",
"refsource": "MISC",
"url": "https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850"
}
]
},
"source": {
"advisory": "34a12146-3a5d-4efc-a0f8-7a3ae04b198d",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1464",
"datePublished": "2022-05-05T13:45:12",
"dateReserved": "2022-04-25T00:00:00",
"dateUpdated": "2024-08-03T00:03:06.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-0415
Vulnerability from cvelistv5
Published
2022-03-21 10:45
Modified
2024-08-02 23:25
Severity ?
EPSS score ?
Summary
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
References
| ▼ | URL | Tags |
|---|---|---|
| https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902 | x_refsource_CONFIRM | |
| https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:25:40.311Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T10:45:13",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284"
}
],
"source": {
"advisory": "b4928cfe-4110-462f-a180-6d5673797902",
"discovery": "EXTERNAL"
},
"title": "Remote Command Execution in uploading repository file in gogs/gogs",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-0415",
"STATE": "PUBLIC",
"TITLE": "Remote Command Execution in uploading repository file in gogs/gogs"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gogs/gogs",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.6"
}
]
}
}
]
},
"vendor_name": "gogs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902"
},
{
"name": "https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284",
"refsource": "MISC",
"url": "https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284"
}
]
},
"source": {
"advisory": "b4928cfe-4110-462f-a180-6d5673797902",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-0415",
"datePublished": "2022-03-21T10:45:13",
"dateReserved": "2022-01-30T00:00:00",
"dateUpdated": "2024-08-02T23:25:40.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-1993
Vulnerability from cvelistv5
Published
2022-06-08 13:55
Modified
2024-08-03 00:24
Severity ?
EPSS score ?
Summary
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
References
| ▼ | URL | Tags |
|---|---|---|
| https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d | x_refsource_CONFIRM | |
| https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.031Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThan": "0.12.9",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Path Traversal in GitHub repository gogs/gogs prior to 0.12.9."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-08T13:55:11",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf"
}
],
"source": {
"advisory": "22f9c074-cf60-4c67-b5c4-72fdf312609d",
"discovery": "EXTERNAL"
},
"title": "Path Traversal in gogs/gogs",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1993",
"STATE": "PUBLIC",
"TITLE": "Path Traversal in gogs/gogs"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "gogs/gogs",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.9"
}
]
}
}
]
},
"vendor_name": "gogs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Path Traversal in GitHub repository gogs/gogs prior to 0.12.9."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d"
},
{
"name": "https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf",
"refsource": "MISC",
"url": "https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf"
}
]
},
"source": {
"advisory": "22f9c074-cf60-4c67-b5c4-72fdf312609d",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1993",
"datePublished": "2022-06-08T13:55:11",
"dateReserved": "2022-06-03T00:00:00",
"dateUpdated": "2024-08-03T00:24:44.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-1884
Vulnerability from cvelistv5
Published
2024-11-15 10:53
Modified
2024-11-15 19:15
Severity ?
EPSS score ?
Summary
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.
References
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gogs",
"vendor": "gogs",
"versions": [
{
"lessThanOrEqual": "0.12.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-1884",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-15T19:13:14.910217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T19:15:02.353Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "gogs/gogs",
"vendor": "gogs",
"versions": [
{
"lessThanOrEqual": "latest",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote command execution vulnerability exists in gogs/gogs versions \u003c=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T10:53:00.844Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai"
},
"references": [
{
"url": "https://huntr.com/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b"
}
],
"source": {
"advisory": "9cd4e7b7-0979-4e5e-9a1c-388b58dea76b",
"discovery": "EXTERNAL"
},
"title": "Remote Command Execution in gogs/gogs"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"cveId": "CVE-2022-1884",
"datePublished": "2024-11-15T10:53:00.844Z",
"dateReserved": "2022-05-25T12:20:16.450Z",
"dateUpdated": "2024-11-15T19:15:02.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}