GitHub Advisoryadvisory · Go

GHSA-ccqv-43vm-4f3w Gogs allows deletion of internal files

CRITICAL Published 2024-12-23 Modified 2024-12-23 Official page ↗
Aliases
CVE-2024-39931
Ecosystem
Go
Packages
gogs.io/gogs
Severity
Critical
CVSS vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
Weaknesses
CWE-552
Reviewed
2024-12-23

Affected packages

• Go gogs.io/gogs: < 0.13.1 → fixed in 0.13.1

Description

Impact Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. Patches Deletion of `.git` files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the latest 0.14.0+dev. Workarounds No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions. References https://www.cve.org/CVERecord?id=CVE-2024-39931

Related

Alias · CVE (1)

  • CVE-2024-39931 Gogs through 0.13.0 allows deletion of internal files. vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References