GitHub Advisoryadvisory · Go

GHSA-7v5r-r995-q2x2 SSRF in repository migration

MEDIUM Published 2022-03-12 Modified 2022-03-24 Official page ↗
Aliases
CVE-2022-0870
Ecosystem
Go
Packages
gogs.io/gogs
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-03-14

Affected packages

• Go gogs.io/gogs: < 0.12.5 → fixed in 0.12.5

Description

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.

Related

Alias · CVE (1)

  • CVE-2022-0870 Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References