GitHub Advisory DatabaseGHSA-9HX4-QM7H-X84JCross-site Scripting in Gogs
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.005 Low
EPSS
Percentile
75.2%
Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
| CPE | Name | Operator | Version |
|---|---|---|---|
| gogs.io/gogs | lt | 0.5.8 |
References
exchange.xforce.ibmcloud.com/vulnerabilities/98693
github.com/advisories/GHSA-9hx4-qm7h-x84j
github.com/gogits/gogs/commit/3abc41cccab2486012b46305827433ad6f5deade
github.com/gogits/gogs/releases/tag/v0.5.8
gogs.io/docs/intro/change_log.html
nvd.nist.gov/vuln/detail/CVE-2014-8683
packetstormsecurity.com/files/129118/Gogs-Markdown-Renderer-Cross-Site-Scripting.html
seclists.org/fulldisclosure/2014/Nov/31
seclists.org/fulldisclosure/2014/Nov/34
www.securityfocus.com/archive/1/533996/100/0/threaded
Related
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.005 Low
EPSS
Percentile
75.2%