| id: GO-2020-0021 |
| modules: |
| - module: github.com/gogits/gogs |
| versions: |
| - fixed: 0.5.8 |
| vulnerable_at: 0.5.5 |
| packages: |
| - package: github.com/gogits/gogs |
| symbols: |
| - GetIssues |
| - SearchRepositoryByName |
| - SearchUserByName |
| skip_fix: 'TODO: Revisit this reason (Some dependencies no longer exist)' |
| summary: SQL Injection in github.com/gogits/gogs |
| description: |- |
| Due to improper sanitization of user input, a number of methods are vulnerable |
| to SQL injection if used with user input that has not been sanitized by the |
| caller. |
| published: 2021-04-14T20:04:52Z |
| cves: |
| - CVE-2014-8681 |
| ghsas: |
| - GHSA-mr6h-chqp-p9g2 |
| credits: |
| - Pascal Turbing |
| - Jiahua (Joe) Chen |
| references: |
| - fix: https://github.com/gogs/gogs/commit/83283bca4cb4e0f4ec48a28af680f0d88db3d2c8 |
| - web: https://seclists.org/fulldisclosure/2014/Nov/31 |
