SQL Injection in Gogs · CVE-2014-8682 · GitHub Advisory Database · GitHub

SQL Injection in Gogs

High severity GitHub Reviewed Published Jun 29, 2021 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

gogs.io/gogs (Go)

Affected versions

>= 0.3.1, < 0.5.8

Patched versions

0.5.8

Description

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.

References

Reviewed May 20, 2021

Published to the GitHub Advisory Database Jun 29, 2021

Last updated Jan 9, 2023

Severity

High

7.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L