Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view
    the report and when open the attachment then xss is executed. This bug allow executed any javascript code
    in victim account . (CVE-2022-1464)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 647ac600-cc70-11ec-9cfc-10c37b4ac2ea advisory.

  - The gogs project reports: Repository issues page allows HTML attachments with arbitrary             JS     code. (CVE-2022-1464)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
427050	Alpine: gogs: security update to 0.12.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
427050	Alpine: gogs: security update to 0.12.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
414458	SCA: security update for gogs.io/gogs (GHSA-ff28-f46g-r9g8)	Tenable Cloud Security	SCA Checks	medium
414458	SCA: security update for gogs.io/gogs (GHSA-ff28-f46g-r9g8)	Tenable Self-Hosted Container Security	SCA Checks	medium
160536	FreeBSD : gogs -- XSS in issue attachments (647ac600-cc70-11ec-9cfc-10c37b4ac2ea)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2022-1464

medium

Tenable Plugins

medium

medium

medium

medium

medium