GHSA-pj96-4jhv-v792

Source

https://github.com/advisories/GHSA-pj96-4jhv-v792

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-pj96-4jhv-v792/GHSA-pj96-4jhv-v792.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pj96-4jhv-v792

Aliases

GO-2022-0473

Published

2022-06-02T20:46:30Z

Modified

2024-08-21T15:42:05Z

Summary

Cross site scripting via cookies in gogs

Details

Impact

There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.

Patches

Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

Workarounds

No need for workarounds.

References

N/A

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-02T20:46:30Z",
    "nvd_published_at": null,
    "severity": "LOW"
}

References

Affected packages

Go / gogs.io/gogs

Package

Name: gogs.io/gogs; View open source insights on deps.dev
Purl: pkg:golang/gogs.io/gogs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-pj96-4jhv-v792/GHSA-pj96-4jhv-v792.json"