CVE-2022-1464: Stored xss bug in gogs/gogs
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/gogsto a version that resolves this vulnerability.Fixed in 0.12.7-r0
Event History
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2022-1464.
What is the title of this vulnerability?
The title of this vulnerability is 'Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7.'
What is the severity rating of CVE-2022-1464?
The severity rating of CVE-2022-1464 is high, with a value of 5.4.
How does this vulnerability allow execution of arbitrary JavaScript code?
This vulnerability allows execution of arbitrary JavaScript code when a user opens an attachment in the vulnerable GitHub repository gogs/gogs.
How can I fix this vulnerability?
To fix this vulnerability, update your gogs/gogs repository to version 0.12.7 or above.