PT-2022-21137 · Gogs · Gogs

Published 2022-10-11 · Updated 2025-05-16 · CVE-2022-32174

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gogs versions v0.6.5 through v0.12.10

Description The issue is related to Stored Cross-Site Scripting (XSS) that can lead to an account takeover.

Recommendations For versions v0.6.5 through v0.12.10, update to a version that is not affected by this issue to prevent account takeover due to Stored Cross-Site Scripting (XSS).

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-32174

GHSA-MCJJ-2FVQ-MC3R

GO-2022-1060

Affected Products

Gogs

References · 11

• 🔥 https://github.com/gogs/gogs/blob/v0.12.10/public/js/gogs.js#L263 · Exploit
• 🔥 https://mend.io/vulnerability-database/CVE-2022-32174 · Exploit
• https://osv.dev/vulnerability/GHSA-mcjj-2fvq-mc3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32174 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32174 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1060 · Vendor Advisory
• https://github.com/gogs/gogs · Note
• https://pkg.go.dev/vuln/GO-2022-1060 · Note
• https://t.me/cibsecurity/51117 · Telegram Post
• https://t.me/cvenotify/122539 · Telegram Post
• https://github.com/advisories/GHSA-mcjj-2fvq-mc3r · Note