icon

We found results for “

CVE-2024-39930

Good to know:

icon

Date: July 3, 2024

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected. The original fix version, 0.13.1, was pulled back due to certain issues. The vendor recommends upgrading to 0.13.2. See https://github.com/gogs/gogs/releases/tag/v0.13.1

Language: Go

Severity Score

Severity Score

Weakness Type (CWE)

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-88

Top Fix

icon

Upgrade Version

Upgrade to version gogs.io/gogs - v0.13.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us