CVE-2022-1464

    Dashboard / Vulnerabilities / CVE-2022-1464

    CVE-2022-1464

    Published: 5 May 2022Last Modified: 12 Aug 2026

    Summary: Stored xss bug in gogs/gogs

    Details: Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .

    References: https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1464.json, https://nvd.nist.gov/vuln/detail/CVE-2022-1464, https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d06ba7e527fcc462aecdb660ce001e87d94f024c

    Affected versions

    v0.12.6-rc.1
    v0.12.6
    v0.12.5-rc.1
    v0.12.5
    v0.12.4-rc.1
    v0.12.4
    v0.12.3
    v0.12.2
    v0.12.1
    v0.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1464 | CVE-DB