CVE-2022-1884漏洞

CVE编号

CVE-2022-1884

利用情况

暂无

补丁情况

N/A

披露时间

2022-06-03

漏洞描述

The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All Windows installations with repository upload enabled (default) are affected.

解决建议

"将组件 gogs.io/gogs/internal/db 升级至 0.12.8 及以上版本"

参考链接
https://github.com/advisories/GHSA-958j-443g-7mm7
https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/co...
https://github.com/gogs/gogs/issues/6968
https://github.com/gogs/gogs/pull/6970
https://github.com/gogs/gogs/releases/tag/v0.12.8
https://github.com/gogs/gogs/security/advisories/GHSA-958j-443g-7mm7
https://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b/

CVSS3评分 N/A

• 攻击路径 N/A
• 攻击复杂度 N/A
• 权限要求 N/A
• 影响范围 N/A
• 用户交互 N/A
• 可用性 N/A
• 保密性 N/A
• 完整性 N/A

N/A

CWE-ID	漏洞类型

Exp相关链接

- avd.aliyun.com