En bref
- CVE-2022-31038 est une vulnérabilité MOYENNE (CVSS 5.4) touchant gogs.io/gogs, gogs (gogs).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.74%, plus élevée que 54.5% des vulnérabilités.
- Correctif : mettre à jour vers 0.12.9 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| gogs.io/gogs Go | < 0.12.9
| 0.12.9
|
| gogs | < 0.12.9
| 0.12.9
|
Description
Impact
DisplayName allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list.
Patches
DisplayName is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.
Workarounds
Check and update the existing users' display names that contain malicious characters.
References
N/A
For more information
If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.
NVD description
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes `DisplayName` prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free