GitHub Advisoryadvisory · Go

GHSA-9pp6-wq8c-3w2c Gogs allows argument injection during the previewing of changes

CRITICAL Published 2024-12-23 Modified 2024-12-23 Official page ↗
Aliases
CVE-2024-39932
Ecosystem
Go
Packages
gogs.io/gogs
Severity
Critical
CVSS vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
Weaknesses
CWE-94
Reviewed
2024-12-23

Affected packages

• Go gogs.io/gogs: < 0.13.1 → fixed in 0.13.1

Description

Impact Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance. Patches Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev. Workarounds No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions. References https://www.cve.org/CVERecord?id=CVE-2024-39932

Related

Alias · CVE (1)

  • CVE-2024-39932 Gogs through 0.13.0 allows argument injection during the previewing of changes. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References