{"id":"CVE-2022-1464","published":"2022-05-05T13:45:12Z","modified":"2024-08-03T00:03:06Z","title":"Stored xss bug in gogs/gogs","vendor":"gogs","product":"gogs/gogs","tier":"tail","description":{"text":"Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .","provenance":"source","from":"CVE.org"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00719,"percentile":0.53742,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850","tags":["x_refsource_MISC"]}],"priority":{"score":15.9,"factors":[{"name":"EPSS percentile","points":10.75},{"name":"CVSS severity","points":5.11}]},"vendorSlug":"gogs","affectedVersions":[{"vendor":"gogs","product":"gogs/gogs","versions":[">= unspecified, < 0.12.7"]}],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.12.7"],"patched":["0.12.7"],"from":["GHSA-ff28-f46g-r9g8","GO-2022-0597"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3755","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-0870","published":"2022-03-11","fixed":"0.12.5","kev":false},{"cve":"CVE-2022-0871","published":"2022-03-11","fixed":"0.12.5","kev":false},{"cve":"CVE-2022-0415","published":"2022-03-21","fixed":"0.12.6","kev":false,"link":{"from":"CVE-2022-0415","to":"CVE-2022-1464","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.12.6","toFixed":"0.12.7","daysApart":45}]}},{"cve":"CVE-2022-1464","published":"2022-05-05","fixed":"0.12.7","kev":false},{"cve":"CVE-2021-32546","published":"2022-05-31","fixed":"0.12.8","kev":false,"link":{"from":"CVE-2022-1464","to":"CVE-2021-32546","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.12.7","toFixed":"0.12.8","daysApart":26}]}},{"cve":"CVE-2022-1285","published":"2022-06-01","fixed":"0.12.8","kev":false,"link":{"from":"CVE-2022-1464","to":"CVE-2022-1285","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.12.7","toFixed":"0.12.8","daysApart":27}]}},{"cve":"CVE-2022-1884","published":"2024-11-15","fixed":"0.12.8","kev":false}],"package":"Go:gogs.io/gogs"}}