PT-2023-9257 · Gogs · Gogs

Published 2023-04-20 · Updated 2025-08-29 · CVE-2024-39931

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gogs versions 0.13.0 and earlier

Description The issue allows an attacker to delete or modify arbitrary files on a vulnerable Gogs server. This can be exploited by a remote attacker. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN USER in the configuration, allowing access and alteration of any users' code hosted on the same instance.

Recommendations For Gogs versions 0.13.0 and earlier, upgrade to 0.13.1 or the latest 0.14.0+dev to resolve the issue. As a temporary workaround, consider granting access only to trusted users to your Gogs instance on affected versions.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2024-05766

CVE-2024-39931

GHSA-2VGJ-3PVG-XH4W

GHSA-CCQV-43VM-4F3W

GO-2024-2970

Affected Products

Gogs

References · 31

• https://osv.dev/vulnerability/GHSA-2vgj-3pvg-xh4w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39931 · Security Note
• https://osv.dev/vulnerability/GO-2024-2970 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ccqv-43vm-4f3w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39931 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05766 · Security Note
• https://github.com/gogs/gogs/releases · Note
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-ccqv-43vm-4f3w · Note
• https://twitter.com/dailycve/status/1961538755267060064 · Twitter Post
• https://gist.githubusercontent.com/paul-gerste-sonarsource/207f5dc79f59bb256a0bfccda4e3e92b/raw/Gogs-security-fixes-by-Sonar.patch · Note
• https://t.me/tmfeed/251301 · Telegram Post
• https://twitter.com/CVEnew/status/1808891353234899056 · Twitter Post
• https://securitylab.ru/news/549911.php · Note
• https://github.com/advisories/GHSA-2vgj-3pvg-xh4w · Note