Vulnerability advisory
CVE-2022-31038
XSS vulnerability in repository issue list in Gogs
Also known as GHSA-xq4v-vrp9-vcf2GO-2022-0483
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/gogs/gogs ↗ | |
| All commits before 012a1ba19ed2f8f5185be4254f655ba6c4b34db2 | 012a1ba19ed2f8f5185be4254f655ba6c4b34db2 |
| Not specified | 155cae1de8916fc3fde78f350763034b7422caee |
Also listed as affected (67)
| |
Description
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.
References
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31038.json ↗
- Advisorygithub.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-31038 ↗
- Fixgithub.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caee ↗
- Fixgithub.com/gogs/gogs/pull/7009 ↗