{"id":"CVE-2022-0870","published":"2022-03-11T10:40:09Z","modified":"2024-08-02T23:40:04Z","title":"Server-Side Request Forgery (SSRF) in gogs/gogs","vendor":"gogs","product":"gogs/gogs","tier":"tail","description":{"text":"Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.","provenance":"source","from":"CVE.org"},"cvss":{"score":5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03422,"percentile":0.88877,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb","tags":["x_refsource_MISC"]}],"priority":{"score":26.3,"factors":[{"name":"EPSS percentile","points":17.78},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.5}]},"exploitSources":{"nuclei":[{"id":"CVE-2022-0870","name":"Gogs <0.12.5 - Server-Side Request Forgery","severity":"medium","path":"http/cves/2022/CVE-2022-0870.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0870.yaml"}],"provenance":"source"},"vendorSlug":"gogs","affectedVersions":[{"vendor":"gogs","product":"gogs/gogs","versions":[">= unspecified, < 0.12.5"]}],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.12.5"],"patched":["0.12.5"],"from":["GHSA-7v5r-r995-q2x2","GO-2022-0566"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1366","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-gogs-gogs-cve-2022-0870","children":[{"from":"CVE-2022-0870","to":"CVE-2022-1285","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["internal/form/repo.go","internal/netutil/netutil.go","internal/route/repo/webhook.go"],"commits":["https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb","https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f"],"basis":"shared function","functions":["ParseRemoteAddr","WebhooksNew"]},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2018-15192","published":"2018-08-08","fixed":"0.12.0","kev":false},{"cve":"CVE-2018-17031","published":"2018-09-14","fixed":"0.12.0","kev":false},{"cve":"CVE-2020-14958","published":"2020-06-21","fixed":"0.12.0","kev":false},{"cve":"CVE-2022-0870","published":"2022-03-11","fixed":"0.12.5","kev":false},{"cve":"CVE-2022-0871","published":"2022-03-11","fixed":"0.12.5","kev":false},{"cve":"CVE-2022-0415","published":"2022-03-21","fixed":"0.12.6","kev":false,"link":{"from":"CVE-2022-0870","to":"CVE-2022-0415","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.12.5","toFixed":"0.12.6","daysApart":10},{"kind":"similar","provenance":"machine","score":0.3,"basis":"same product + description similarity"}]}},{"cve":"CVE-2022-1464","published":"2022-05-05","fixed":"0.12.7","kev":false}],"package":"Go:gogs.io/gogs"}}