CVE-2024-44625

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-44625
Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/ Exploit Third Party Advisory
https://gogs.io/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*
History

19 Nov 2024, 21:51

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-22
First Time Gogs gogs
Gogs
References () https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/ - () https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/ - Exploit, Third Party Advisory
References () https://gogs.io/ - () https://gogs.io/ - Product
CPE cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*

18 Nov 2024, 17:11

Type Values Removed Values Added
Summary
  • (es) Gogs &lt;=0.13.0 es vulnerable a la navegación de Directory Traversal de la función editFilePost de internal/route/repo/editor.go.

15 Nov 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-15 17:15

Updated : 2024-11-19 21:51

NVD link : CVE-2024-44625

Mitre link : CVE-2024-44625

CVE.ORG link : CVE-2024-44625

JSON object : View

Products Affected

gogs

  • gogs
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')