SB2022101409 - Multiple vulnerabilities in gogs



SB2022101409 - Multiple vulnerabilities in gogs

Published: October 14, 2022 Updated: April 27, 2026

Security Bulletin ID SB2022101409
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Stored cross-site scripting (CVE-ID: CVE-2022-32174)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear


The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the select assignee component. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) OS Command Injection (CVE-ID: CVE-2022-2024)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to gain SSH access to the server.

The vulnerability exists due to improper neutralization of special elements used in an os command in the repo editor upload path handling for the repository's .git directory when processing crafted repository uploads and file deletions on case-insensitive file systems. A remote user can upload a crafted config file and trigger crafted file deletion to gain SSH access to the server.

Only installations with repository upload enabled on case-insensitive file systems are vulnerable.


Remediation

Install update from vendor's website.