What is GHSA-6vcc-v9vw-g2x5?

GHSA-6vcc-v9vw-g2x5 is a security advisory published by GitHub Security Advisories with High severity. Path Traversal in Git HTTP endpoints in Gogs

Which CVE IDs does GHSA-6vcc-v9vw-g2x5 cover?

GHSA-6vcc-v9vw-g2x5 covers the following CVE IDs: CVE-2022-1993. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6vcc-v9vw-g2x5?

GHSA-6vcc-v9vw-g2x5 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6vcc-v9vw-g2x5?

GHSA-6vcc-v9vw-g2x5 affects 1 product, including: go/gogs.io/gogs:\u003c 0.12.9.

GHSA-6vcc-v9vw-g2x5HighCVSS 8.1

Path Traversal in Git HTTP endpoints in Gogs

Vendor

GitHub Security Advisories

Published

June 8, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-1993 →

📋 Description

Impact

The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected.

Patches

Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

Workarounds

N/A

References

https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d/

For more information

If you have any questions or comments about this advisory, please post on #7002.

🎯 Affected products1

go/gogs.io/gogs:< 0.12.9

🔗 References (7)

https://github.com/gogs/gogs/security/advisories/GHSA-6vcc-v9vw-g2x5
https://github.com/gogs/gogs/issues/7002
https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf
https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d/
https://nvd.nist.gov/vuln/detail/CVE-2022-1993
https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d
https://github.com/advisories/GHSA-6vcc-v9vw-g2x5