{"id":"CVE-2022-32174","published":"2022-10-11T14:20:16Z","modified":"2025-05-16T13:49:17Z","title":"Gogs - XSS","vendor":"gogs","product":"gogs","tier":"core","eol":null,"affectedVersions":[{"vendor":"gogs","product":"gogs","versions":[">= v0.6.5, < unspecified",">= unspecified, <= v0.12.10"]}],"description":{"text":"In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Gogs self-hosted Git service, in versions v0.6.5 through v0.12.10, contains a stored cross-site scripting flaw (CWE-79, improper neutralization of input during web page generation). An attacker who can place malicious content that is later rendered in a victim's browser needs low privileges and user interaction, and can use it to take over the victim's account.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:54Z"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.58246,"percentile":0.99091,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)","url":"https://otx.alienvault.com/pulse/67c6bb5aa601e91b1314ff44","created":"2025-03-04"},{"name":"Thor Linux Lite Scan - Sample Device & SG2 - 02.07.25 - Unenriched","url":"https://otx.alienvault.com/pulse/67a219f7c06d372f86335d64","created":"2025-02-04"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.mend.io/vulnerability-database/CVE-2022-32174","tags":[]},{"url":"https://github.com/gogs/gogs/blob/v0.12.10/public/js/gogs.js#L263","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":[">=0.6.5, <=0.12.10",">=0.6.5"],"patched":[],"from":["GHSA-mcjj-2fvq-mc3r","GO-2022-1060"],"provenance":"source"}],"advisories":[{"id":"GHSA-mcjj-2fvq-mc3r","url":"https://github.com/advisories/GHSA-mcjj-2fvq-mc3r","severity":"CRITICAL","ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":[">=0.6.5, <=0.12.10"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-7125","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7125","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-10-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-32174","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":27.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9909"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}