Lucene search

GoogleOSV:CVE-2022-32174

HistoryOct 11, 2022 - 3:15 p.m.

CVE-2022-32174

2022-10-1115:15:09

Google

osv.dev

gogs

cross-site scripting

account takeover

vulnerable software

7.7 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.6%

JSON

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

CPENameOperatorVersion
gogseq0.9.141
gogseq0.12.6
gogseq0.11.91
gogseq0.11.79
gogseq0.11
gogseq0.12.10
gogseq0.7.33
gogseq0.11.29
gogseq0.9.13
gogseq0.7.0

Name	Operator	Version
gogs	eq	0.9.141
gogs	eq	0.12.6
gogs	eq	0.11.91
gogs	eq	0.11.79
gogs	eq	0.11
gogs	eq	0.12.10
gogs	eq	0.7.33
gogs	eq	0.11.29
gogs	eq	0.9.13
gogs	eq	0.7.0

Rows per page:

1-10 of 621

References

github.com/gogs/gogs/blob/v0.12.10/public/js/gogs.js#L263

www.mend.io/vulnerability-database/CVE-2022-32174