CVE-2024-39933

highpriority · track · 31EPSS 0.007 · 53 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.69% (53rd) EPSS
CVSS 7.7 · high
Is it mine?
8 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Gogs through 0.13.0 allows argument injection during the tagging of a new release.

01

cvss

Technical severity, 0–10. One row per scoring source.

7.7
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.1 · impact 4
v3.17.7highAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU
v3.17.7highCVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:Nsecondary · ENISA EU
v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · cve@mitre.org USexploitability 3.1 · impact 4
v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · OSV
v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-88USCWE-88USCWE-88US
04

affected products (8)

Products and version ranges known to be affected.

05

advisories (4)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2026-2013Gogs: Mehrere SchwachstellenDeutsch2026-06-18csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen – sogar mit erweiterten Berechtigungen, was zur vollständigen Kontrolle über das System führen kann –, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder einen Denial-of-Service-Zustand zu verursachen.

  • GHSA-8mm6-wmpp-mmm3Duplicate Advisory: Gogs allows argument injection during the tagging of a new release2024-07-04ghsa · osvUS

    # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references. # Original Description Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixed as of the time of this advisory being published.

  • GHSA-m27m-h5gj-wwmgGogs allows argument Injection when tagging new releases2024-12-23ghsa · osvUS

    ### Impact Unprivileged user accounts with at least one SSH key can read arbitrary files on the system. For instance, they could leak the configuration files that could contain database credentials (`[database] *`) and `[security] SECRET_KEY`. Attackers could also exfiltrate TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled. ### Patches Unintended Git options has been ignored for creating tags (https://github.com/gogs/gogs/pull/7872). Users should upgrade to 0.13.1 or the latest 0.14.0+dev. ### Workarounds No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions. ### References https://www.cve.org/CVERecord?id=CVE-2024-39933

  • GO-2024-2972Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs2024-07-09vendor · osvUS

    Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs

06

also known as (7)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdNVDCVE.orgMITRE
published 2024-07-04modified 2026-06-17
08

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan