Gogs vulnerability allows argument injection during new release tagging
CVE-2024-39933

7.7HIGH

Key Information:

Vendor

Gogs

Status
Gogs
Vendor
CVE Published:
4 July 2024

What is CVE-2024-39933?

Gogs, a popular self-hosted Git service, is affected by a vulnerability that allows argument injection during the process of tagging a new release. This flaw can lead to unauthorized manipulation of release tags, potentially impacting version integrity and overall application security. Users of Gogs versions prior to 0.13.0 should assess their exposure and take necessary actions to mitigate the risks associated with this vulnerability.

References

https://github.com/gogs/gogs/releases
https://www.sonarsource.com/blog/securing-developer-tools...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.