GitHub Advisoryadvisory · Go

GHSA-9hx4-qm7h-x84j Cross-site Scripting in Gogs

MEDIUM Published 2021-06-29 Modified 2021-05-20 Official page ↗
Aliases
CVE-2014-8683
Ecosystem
Go
Packages
gogs.io/gogs
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2021-05-20

Affected packages

• Go gogs.io/gogs: >= 0.3.1, < 0.5.8 → fixed in 0.5.8

Description

Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.

Related

Alias · CVE (1)

  • CVE-2014-8683 Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References