What is GHSA-fg3x-rwq9-74cw?

GHSA-fg3x-rwq9-74cw is a security advisory published by GitHub Security Advisories with High severity. Gogs and Gitea SSRF Vulnerability

Which CVE IDs does GHSA-fg3x-rwq9-74cw cover?

GHSA-fg3x-rwq9-74cw covers the following CVE IDs: CVE-2018-15192. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fg3x-rwq9-74cw?

GHSA-fg3x-rwq9-74cw has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

Which products are affected by GHSA-fg3x-rwq9-74cw?

GHSA-fg3x-rwq9-74cw affects 2 products, including: go/code.gitea.io/gitea:\u003c 1.16.0-rc1; go/gogs.io/gogs:\u003c 0.12.0.

GHSA-fg3x-rwq9-74cwHighCVSS 8.6

Gogs and Gitea SSRF Vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

October 6, 2023

🔗 CVE IDs covered (1)

CVE-2018-15192 →

📋 Description

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

🎯 Affected products2

go/code.gitea.io/gitea:< 1.16.0-rc1
go/gogs.io/gogs:< 0.12.0

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2018-15192
https://github.com/go-gitea/gitea/issues/4624
https://github.com/gogs/gogs/issues/5366
https://github.com/go-gitea/gitea/pull/17482
https://github.com/gogs/gogs/pull/6002
https://github.com/go-gitea/gitea/commit/599ff1c054e436daa4dc3f049aa8661d9c2395f9
https://github.com/gogs/gogs/commit/22717a1c064511cf37c46af5e650baf7184cf25b
https://github.com/advisories/GHSA-fg3x-rwq9-74cw