GitHub Advisoryadvisory · Go

GHSA-g6xv-8q23-w2q3 SQL Injection in Gogs

HIGH Published 2021-06-29 Modified 2021-05-20 Official page ↗
Aliases
CVE-2014-8682
Ecosystem
Go
Packages
gogs.io/gogs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-89
Reviewed
2021-05-20

Affected packages

• Go gogs.io/gogs: >= 0.3.1, < 0.5.8 → fixed in 0.5.8

Description

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.

Related

Alias · CVE (1)

  • CVE-2014-8682 Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References