PT-2020-14088 · Gogs · Gogs

Muxishuihan · Published 2020-06-21 · Updated 2024-08-21 · CVE-2020-14958

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gogs version 0.11.91

Description The issue is related to insecure permissions in Gogs, specifically in the MakeEmailPrimary function located in models/user mail.go. This function lacks a check to ensure the user is the owner of the email, potentially leading to security issues.

Recommendations For Gogs version 0.11.91, consider modifying the MakeEmailPrimary function in models/user mail.go to include a check that verifies the user is the owner of the email before allowing changes to email settings. As a temporary workaround, consider restricting access to the email modification functionality until a proper fix is implemented.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2020-14958

GHSA-4C7M-VV47-7C69

GO-2022-0788

Affected Products

Gogs

References · 8

• https://github.com/gogs/gogs/pull/5988 · Patch
• https://github.com/gogs/gogs/commit/82ff0c5852f29daa5f95d965fd50665581e7ea3c · Patch
• https://osv.dev/vulnerability/GO-2022-0788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14958 · Security Note
• https://osv.dev/vulnerability/GHSA-4c7m-vv47-7c69 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14958 · Vendor Advisory
• https://t.me/cvenotify/4543 · Telegram Post
• https://github.com/advisories/GHSA-4c7m-vv47-7c69 · Note