Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-1884

Good to know:

icon

Date: November 15, 2024

The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All Windows installations with repository upload enabled (default) are affected. Converted from WS-2022-0143, on 2022-11-07.

Language: Go

Severity Score

Related Resources (10)

https://github.com/gogs/gogs/releases/tag/v0.12.8
https://github.com/gogs/gogs/security/advisories/GHSA-958j-443g-7mm7
https://github.com/gogs/gogs/pull/6970
https://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b
https://github.com/gogs/gogs
https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129
https://nvd.nist.gov/vuln/detail/CVE-2022-1884
https://github.com/gogs/gogs/issues/6968
https://huntr.com/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b
https://www.mend.io/vulnerability-database/CVE-2022-1884

Severity Score

Weakness Type (CWE)

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-77

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

Top Fix

icon

Upgrade Version

Upgrade to version gogs.io/gogs - v0.12.8

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us