GHSA-7V5R-R995-Q2X2 SSRF in repository migration

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users...

SSRF in repository migration

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users...

GHSA-65F3-3278-7M65 Duplicate Advisory: Improper Authorization in Gogs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gw5h-h6hj-f56g. This link is maintained to preserve external references. Original Description Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use...

Improper Authorization in Gogs

Improper Authorization in GitHub repository gogs/gogs prior to 0.12.5...

SSRF in repository migration

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

Remote Command Execution in uploading repository file

Description When uploading a file to the repository in Gogs, the treepath parameter is not been validated. The attacker can set treepath=/.git/ to upload file into the .git directory. Rewrite .git/config file and set core.sshCommand, which leads to remote command execution vulnerability. Proof of...

CVE-2022-0871

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0871

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

Authorization

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870 Server-Side Request Forgery (SSRF) in gogs/gogs

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Gogs (gogs/gogs) prior to version 0.12.5 is affected by a Server-Side Request Forgery (SSRF) vulnerability in the repository migration logic. The issue enables an attacker to trigger SSRF via the affected migration pathway, with reachable impact limited to information exposure or unauthorized int...

CVE-2022-0870 Server-Side Request Forgery (SSRF) in gogs/gogs

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0871

CVE-2022-0871 affects Gogs (gogs/gogs) prior to 0.12.5 and is described as Missing Authorization. Connected advisories/documents consistently describe improper PAM authorization handling as the root cause and indicate that updated builds fix the issue, recommending upgrading to 0.12.5 or (for new...

PT-2022-13488 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.5 Description: The issue is related to Server-Side Request Forgery SSRF in the repository migration functionality of gogs. This allows a malicious user to discover services in the internal network. All installation...

CVE-2022-0871: Missing Authorization

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

PT-2022-13489 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.5 Description: The issue concerns improper authorization handling in installations that use PAM as authentication sources. Expired PAM accounts and accounts with expired passwords are continued to be seen as valid...