CVE-2024-39931: Critical severity Gogs Gogs vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ccqv-43vm-4f3w. This link is maintained to preserve external references.
Original Description Gogs through 0.13.0 allows deletion of internal files.
Other sources
Impact
Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUNUSER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.
Patches
Deletion of .git files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
References
https://www.cve.org/CVERecord?id=CVE-2024-39931
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39931?
CVE-2024-39931 has been withdrawn as it is a duplicate of another advisory, thus the severity is not assessed.
How do I fix CVE-2024-39931?
To address CVE-2024-39931, update to Gogs version 0.13.1 as earlier versions are affected.
What vulnerabilities are associated with CVE-2024-39931?
CVE-2024-39931 allows unprivileged users to delete internal files in Gogs up to version 0.13.0.
Which versions of Gogs are affected by CVE-2024-39931?
Gogs versions up to and including 0.13.0 are affected by CVE-2024-39931.
What is the main risk of exploiting CVE-2024-39931?
The main risk of exploiting CVE-2024-39931 is unauthorized file deletion by unprivileged user accounts.