CVE-2022-0871
published 2022-03-11CVE-2022-0871: Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.
PriorityP348critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.22%
64.9th percentile
Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gogs.io | gogs | >= 0 < 0.12.5 | 0.12.5 |
| gogs | gogs | < 0.12.5 | 0.12.5 |
| gogs | gogs_gogs | >= unspecified < 0.12.5 | 0.12.5 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv3.08.2HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Gogs vulnerable to improper PAM authorization handling in gogs.io/gogs
osv·2024-08-21
CVE-2022-0871 Gogs vulnerable to improper PAM authorization handling in gogs.io/gogs
Gogs vulnerable to improper PAM authorization handling in gogs.io/gogs
Gogs vulnerable to improper PAM authorization handling in gogs.io/gogs
GHSA
OpenNMS Horizon XXE Injection Vulnerability
ghsa·2023-08-11
CVE-2023-0871 [HIGH] CWE-611 OpenNMS Horizon XXE Injection Vulnerability
OpenNMS Horizon XXE Injection Vulnerability
XXE injection in `/rtc/post/ endpoint` in OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OSV
Gogs vulnerable to improper PAM authorization handling
osv·2022-03-14
CVE-2022-0871 [HIGH] Gogs vulnerable to improper PAM authorization handling
Gogs vulnerable to improper PAM authorization handling
### Impact
Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.
### Patches
Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.
### Workarounds
In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L ` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login.
### References
https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/
### For more information
If you have any questions or comments about this advisory, please post on ht
GHSA
Gogs vulnerable to improper PAM authorization handling
ghsa·2022-03-14
CVE-2022-0871 [HIGH] CWE-862 Gogs vulnerable to improper PAM authorization handling
Gogs vulnerable to improper PAM authorization handling
### Impact
Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.
### Patches
Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.
### Workarounds
In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L ` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login.
### References
https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/
### For more information
If you have any questions or comments about this advisory, please post on ht
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-03-11
Published