Lucene search
+L

CVE-2024-39930

🗓️ 04 Jul 2024 00:00:00Reported by mitreType 
cve
 cve
🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 292 Views🌐 WEB

Gogs SSH server allows argument injection leading to remote code executio

Related
Detection
Refs
Paths
Social
NVD
Vulnrichment
Node
gogsgogsRange0.13.0
ParameterPositionPathDescriptionCWE
namerequest body/api/v1/users/{username}/tokensAuthentication API token creation endpoint used in exploit to obtain a token for further actions.CWE-88
namerequest body/api/v1/users/{username}/reposRepository creation endpoint used to create a repo for hosting attacker-controlled content.CWE-88
descriptionrequest body/api/v1/users/{username}/reposRepository creation endpoint used to create a repo for hosting attacker-controlled content.CWE-88
privaterequest body/api/v1/users/{username}/reposRepository creation endpoint used to create a repo for hosting attacker-controlled content.CWE-88
titlerequest body/api/v1/user/keysSSH key upload endpoint used to add an attacker-proprovided SSH public key to the account.CWE-88
keyrequest body/api/v1/user/keysSSH key upload endpoint used to add an attacker-proprovided SSH public key to the account.CWE-88
idpath/api/v1/user/keys/{id}SSH key deletion endpoint used in cleanup of existing keys before inserting a new one during the exploit.CWE-88

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation