PT-2022-13489 · Gogs · Gogs

Published 2022-03-11 · Updated 2024-08-21 · CVE-2022-0871

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions gogs versions prior to 0.12.5

Description The issue concerns improper authorization handling in installations that use PAM as authentication sources. Expired PAM accounts and accounts with expired passwords are continued to be seen as valid.

Recommendations For versions prior to 0.12.5, upgrade to 0.12.5 or the latest 0.13.0+dev. As a temporary workaround, in addition to marking PAM accounts as expired, also disable/lock them by running usermod -L <username>.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-862

CWE-285

Related Identifiers

CVE-2022-0871

GHSA-65F3-3278-7M65

GHSA-GW5H-H6HJ-F56G

GO-2022-0369

Affected Products

Gogs

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0871.json · Exploit
• 🔥 https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62 · Exploit
• https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78 · Patch
• https://osv.dev/vulnerability/GHSA-65f3-3278-7m65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0871 · Security Note
• https://osv.dev/vulnerability/GO-2022-0369 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gw5h-h6hj-f56g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0871 · Vendor Advisory
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-gw5h-h6hj-f56g · Note
• https://github.com/gogs/gogs/issues/6810 · Note
• https://t.me/cibsecurity/38780 · Telegram Post
• https://t.me/cvenotify/28097 · Telegram Post