CVE-2018-17031

2018-09-1402:29:00

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.5%

JSON

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an “X-Content-Type-Options: nosniff” header is not sent.

CPENameOperatorVersion
gogseq0.11.34
gogseq0.4.1
gogseq0.5.0
gogseq0.9.48
gogseq0.7.6
gogseq0.4.2
gogseq0.5.9
gogseq0.9.128
gogseq0.8.10
gogseq0.11.19