Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05OTRmLTdnODYtcXI1Ns4AArcn

Path Traversal in file editor on Windows in Gogs

Impact

The malicious user is able to delete and upload arbitrary file(s). All installations on Windows with repository upload enabled (default) are affected.

Patches

Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

Workarounds

N/A

References

https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/

For more information

If you have any questions or comments about this advisory, please post on #7001.

Permalink: https://github.com/advisories/GHSA-994f-7g86-qr56
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OTRmLTdnODYtcXI1Ns4AArcn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Identifiers: GHSA-994f-7g86-qr56, CVE-2022-1992
References:

• https://github.com/gogs/gogs/security/advisories/GHSA-994f-7g86-qr56
• https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0
• https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129
• https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/
• https://nvd.nist.gov/vuln/detail/CVE-2022-1992
• https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab
• https://github.com/advisories/GHSA-994f-7g86-qr56

Repository: https://github.com/gogs/gogs
Blast Radius: 0.0

Affected Packages