CVE-2022-0871 — Missing Authorization in Gogs

CWE-862 — Missing AuthorizationCWE-611 — XML External Entity (XXE) Injection5 documents3 sources
Severity
9.1CRITICALNVD
EPSS
1.0%
top 22.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Gogs GogsGogs.io GogsGogs
Timeline
PublishedMar 11
Latest updateAug 21

Description

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages3 packages

▶NVDgogs/gogs< 0.12.5
▶Gogogs.io/gogs< 0.12.5
▶CVEListV5gogs/gogs_gogsunspecified — 0.12.5

Patches

Patch: github.com ↗Patch: huntr.dev ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Gogs vulnerable to improper PAM authorization handling in gogs.io/gogs↗2024-08-21
▶
GHSA
OpenNMS Horizon XXE Injection Vulnerability↗2023-08-11
▶
OSV
Gogs vulnerable to improper PAM authorization handling↗2022-03-14
▶
GHSA
Gogs vulnerable to improper PAM authorization handling↗2022-03-14
▶