GitHub Advisoryadvisory · Go

GHSA-mr6h-chqp-p9g2 SQL Injection in gogs.io/gogs

MEDIUM Published 2021-06-29 Modified 2023-02-09 Official page ↗
Aliases
CVE-2014-8681
Ecosystem
Go
Packages
gogs.io/gogs, github.com/gogits/gogs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-89
Reviewed
2021-05-19

Affected packages

• Go gogs.io/gogs: >= 0.3.1, < 0.5.8 → fixed in 0.5.8 • Go github.com/gogits/gogs: >= 0.3.1, < 0.5.8 → fixed in 0.5.8

Description

SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.

Related

Alias · CVE (1)

  • CVE-2014-8681 SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References