CVE-2024-39932: Argument Injection in Gogs
Summary
CVE-2024-39932: Duplicate Advisory: Gogs allows argument injection during the previewing of changes. Affects github.com/gogs/gogs versions < 0.13.0. No fix is published. How to fix ↓
Also tracked for
- gogs.io/gogs · Go
The same CVE-2024-39932 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, users, and organizations. Gogs allows users to preview changes before committing them. However, versions up to 0.13.0 are vulnerable to argument injection during the previewing of changes.
Vulnerability Detail
The vulnerability in Gogs allows an attacker to inject arguments during the previewing of changes. This can lead to various security issues, including remote code execution, privilege escalation, and unauthorized access to sensitive information. The vulnerability has a CVSS score of 9.9, indicating its critical severity. It affects Gogs versions up to 0.13.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Gogs to the patched version to ensure the security of the application.
Conclusion
Gogs versions up to 0.13.0 are vulnerable to argument injection during the previewing of changes. This critical vulnerability can lead to remote code execution, privilege escalation, and unauthorized access to sensitive information. Users should promptly update their Gogs installation to version 0.13.1 or later to mitigate the risk of exploitation.
See every vulnerability recorded for github.com/gogs/gogs →
FAQ
Gogs is a self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, users, and organizations.
Argument injection is a technique where an attacker can manipulate the arguments passed to a function or command. In the case of Gogs, it allows an attacker to inject malicious arguments during the previewing of changes.
This vulnerability can lead to remote code execution, privilege escalation, and unauthorized access to sensitive information. It poses a significant risk to the security and integrity of the affected Gogs installations.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Gogs installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing a convenient way to assess the security of your software.
Yes, a fix is available for this vulnerability. It is recommended to upgrade Gogs to version 0.13.1 or later, which includes a patch for the argument injection issue.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gogs/gogs.
