GHSA-px5r-fqj6-r2f8MediumCVSS 6.1

Gogs XSS Vulnerability

Published
May 14, 2022
Last Modified
October 6, 2023

🔗 CVE IDs covered (1)

CVE-2018-17031 →

📋 Description

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.

🎯 Affected products1

  • go/gogs.io/gogs:<= 0.11.53

🔗 References (5)