GHSA-7v5r-r995-q2x2

ghsaUSosv

SSRF in repository migration

view advisory published 2022-03-12Licence: CC-BY-4.0

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-0870US	medium5.3	3.42% (89th)	—	2022-03-11
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.

references

External citations — patches, advisories, analysis.

https://github.com/gogs/gogsPACKAGE
https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabbWEB
https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-0870ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan