GHSA-7v5r-r995-q2x2

Source

https://github.com/advisories/GHSA-7v5r-r995-q2x2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-7v5r-r995-q2x2/GHSA-7v5r-r995-q2x2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7v5r-r995-q2x2

Aliases

Published

2022-03-12T00:00:34Z

Modified

2024-08-21T15:26:41.990931Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

SSRF in repository migration

Details

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.

Database specific

{
    "nvd_published_at": "2022-03-11T11:15:00Z",
    "github_reviewed_at": "2022-03-14T22:57:02Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Go / gogs.io/gogs

Package

Name: gogs.io/gogs; View open source insights on deps.dev
Purl: pkg:golang/gogs.io/gogs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.12.5