CVE-2018-20303

Published: Dic 20, 2018 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2022-3398 Aliases: GHSA-9hxg-w7qf-hh93
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none
MEDIUM 5,0
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: none
Confidentiality: none
Integrity: partial
Availability: none

Description

AI Translation Available

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0247
Percentile
0,8th
Updated

EPSS Score Trend (Last 90 Days)

22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
Application

Gogs by Gogs

Product Information
Vendor Gogs
Product Gogs
Version Range Affected
To 0.11.82.1218 (exclusive)
cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b…
Patch Third Party Advisory
https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce
https://github.com/gogs/gogs/issues/5558
Issue Tracking Patch Third Party Advisory
https://github.com/gogs/gogs/issues/5558
https://pentesterlab.com/exercises/cve-2018-18925/
Exploit Third Party Advisory
https://pentesterlab.com/exercises/cve-2018-18925/
https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b…
Patch Third Party Advisory
https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce
https://github.com/gogs/gogs/issues/5558
Issue Tracking Patch Third Party Advisory
https://github.com/gogs/gogs/issues/5558
https://pentesterlab.com/exercises/cve-2018-18925/
Exploit Third Party Advisory
https://pentesterlab.com/exercises/cve-2018-18925/