What is GHSA-xq4v-vrp9-vcf2?

GHSA-xq4v-vrp9-vcf2 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting vulnerability in repository issue list in Gogs

Which CVE IDs does GHSA-xq4v-vrp9-vcf2 cover?

GHSA-xq4v-vrp9-vcf2 covers the following CVE IDs: CVE-2022-31038. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xq4v-vrp9-vcf2?

GHSA-xq4v-vrp9-vcf2 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-xq4v-vrp9-vcf2?

GHSA-xq4v-vrp9-vcf2 affects 1 product, including: go/gogs.io/gogs:\u003c 0.12.9.

GHSA-xq4v-vrp9-vcf2MediumCVSS 5.4

Cross-site Scripting vulnerability in repository issue list in Gogs

Vendor

GitHub Security Advisories

Published

June 8, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-31038 →

📋 Description

Impact

DisplayName allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list.

Patches

DisplayName is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

Workarounds

Check and update the existing users' display names that contain malicious characters.

References

N/A

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.

🎯 Affected products1

go/gogs.io/gogs:< 0.12.9

🔗 References (6)

https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2
https://github.com/gogs/gogs/pull/7009
https://github.com/gogs/gogs/releases/tag/v0.12.9
https://nvd.nist.gov/vuln/detail/CVE-2022-31038
https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caee
https://github.com/advisories/GHSA-xq4v-vrp9-vcf2