Описание
Path Traversal in file editor on Windows in Gogs
Impact
The malicious user is able to delete and upload arbitrary file(s). All installations on Windows with repository upload enabled (default) are affected.
Patches
Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.
Workarounds
N/A
References
https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/
For more information
If you have any questions or comments about this advisory, please post on #7001.
Ссылки
- https://github.com/gogs/gogs/security/advisories/GHSA-994f-7g86-qr56
- https://nvd.nist.gov/vuln/detail/CVE-2022-1992
- https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0
- https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129
- https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab
Пакеты
Наименование
gogs.io/gogs
go
Затронутые версииВерсия исправления
< 0.12.9
0.12.9
Связанные уязвимости
CVSS3: 9.1
nvd
больше 3 лет назад
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.