PT-2023-9258 · Gogs · Gogs

Published 2023-04-20 · Updated 2026-05-29 · CVE-2024-39932

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Gogs versions through 0.13.0

Description The issue is related to argument injection during the previewing of changes, which can allow a remote attacker to execute arbitrary commands. Unprivileged user accounts can write to arbitrary files on the filesystem, potentially forcing a re-installation of the instance and granting administrator rights. This allows accessing and altering any user's code hosted on the same instance.

Recommendations For Gogs versions through 0.13.0, upgrade to 0.13.1 or the latest 0.14.0+dev to resolve the issue. As a temporary measure, only grant access to trusted users to your Gogs instance on affected versions.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-05767

CVE-2024-39932

GHSA-9PP6-WQ8C-3W2C

GHSA-HF29-9HFH-W63J

GO-2024-2971

Affected Products

Gogs

References · 26

• 🔥 https://sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1 · Exploit
• https://osv.dev/vulnerability/GHSA-9pp6-wq8c-3w2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39932 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39932 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf29-9hfh-w63j · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2971 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05767 · Security Note
• https://github.com/gogs/gogs/releases · Note
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-9pp6-wq8c-3w2c · Note
• https://twitter.com/CveFindCom/status/1808894157672337523 · Twitter Post
• https://t.me/cvenotify/118592 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1808935389056401607 · Twitter Post
• https://securitylab.ru/news/549911.php · Note
• https://gist.githubusercontent.com/paul-gerste-sonarsource/207f5dc79f59bb256a0bfccda4e3e92b/raw/Gogs-security-fixes-by-Sonar.patch · Note