CVE-2022-1884: falha crítica em gogs/gogs
Remote Command Execution in gogs/gogs
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 1.8%
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
gogs · gogs/gogsCVEs relacionadas — gogs/gogs
No mesmo produto, das mais perigosas para as menos.
CVE-2022-2024CRITICALOS Command Injection in gogs/gogsEPSS 97.8%CVE-2022-0415CRITICALRemote Command Execution in uploading repository file in gogs/gogsEPSS 65.9%CVE-2022-1993HIGHPath Traversal in gogs/gogsEPSS 36.7%CVE-2022-1986CRITICALOS Command Injection in gogs/gogsEPSS 4.2%CVE-2022-0870MEDIUMServer-Side Request Forgery (SSRF) in gogs/gogsEPSS 3.4%CVE-2022-1992CRITICALPath Traversal in gogs/gogsEPSS 2.3%