CVE-2022-2024 — OS Command Injection in Gogs
CWE-78 — OS Command InjectionCWE-400 — Uncontrolled Resource ConsumptionCWE-476 — NULL Pointer DereferenceCWE-787 — Out-of-bounds WriteCWE-284 — Improper Access ControlCWE-327 — Use of a Broken or Risky Cryptographic AlgorithmCWE-347 — Improper Verification of Cryptographic SignatureCWE-369 — Divide By ZeroCWE-22 — Path TraversalCWE-426 — Untrusted Search PathCWE-1303 — Non-Transparent Sharing of Microarchitectural ResourcesCWE-59 — Link FollowingCWE-416 — Use After FreeCWE-407 — Inefficient Algorithmic ComplexityCWE-789 — Memory Allocation with Excessive Size Value44 documents15 sources
Severity
9.8CRITICALNVD
GHSA7.5OSV6.5OSV5.5OSV4.7
EPSS
42.3%
top 2.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 25
Latest updateMar 24
Description
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages52 packages
Patches
🔴Vulnerability Details
13📋Vendor Advisories
11Red Hat
▶
🕵️Threat Intelligence
2📐Framework References
1💬Community
1Bugzilla▶
CVE-2022-48619 kernel: event code falling outside of a bitmap in input_set_capability() leads to panic↗2024-01-12