CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2022-1464
Medium (5.4) in gogs gogs. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in gogs.io/gogs 0.12.7.
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gogs:gogs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ff28-f46g-r9g8 | Go | gogs.io/gogs | <0.12.7 | 0.12.7 |
| GO-2022-0597 | Go | gogs.io/gogs | <0.12.7 | 0.12.7 |