CVE-2020-14958 — Improper Preservation of Permissions in Gogs

CWE-281 — Improper Preservation of Permissions4 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 63.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Gogs.io GogsGogs
Timeline
PublishedJun 21
Latest updateAug 21

Description

In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Gogogs.io/gogs< 0.12.0
▶NVDgogs/gogs0.11.91

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Insecure Permissions in Gogs in gogs.io/gogs↗2024-08-21
▶
GHSA
Insecure Permissions in Gogs↗2021-05-18
▶
OSV
Insecure Permissions in Gogs↗2021-05-18
▶