GitHub Advisoryadvisory · Go

GHSA-xq4v-vrp9-vcf2 Cross-site Scripting vulnerability in repository issue list in Gogs

MEDIUM Published 2022-06-08 Modified 2022-06-08 Official page ↗
Aliases
CVE-2022-31038
Ecosystem
Go
Packages
gogs.io/gogs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2022-06-08

Affected packages

• Go gogs.io/gogs: < 0.12.9 → fixed in 0.12.9

Description

Impact `DisplayName` allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list. Patches `DisplayName` is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds Check and update the existing users' display names that contain malicious characters. References N/A For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.

Related

Alias · CVE (1)

  • CVE-2022-31038 Gogs is an open source self-hosted Git service. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References