FreeBSD : gogs -- open redirect vulnerability (e53a908d-a645-11e8-8acd-10c37b4ac2ea)

High Nessus Plugin ID 112073


The remote FreeBSD host is missing a security-related update.


bluecatli (Tencent's Xuanwu Lab) reports :

The function isValidRedirect in gogs/routes/user/auth.go is used in
login action to validate if url is on the same site.

If the Location header startswith /\, it will be transformed to // by


Update the affected package.

See Also

Plugin Details

Severity: High

ID: 112073

File Name: freebsd_pkg_e53a908da64511e88acd10c37b4ac2ea.nasl

Version: 1.2

Type: local

Published: 2018/08/23

Modified: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:gogs, cpe:/o:freebsd:freebsd

Patch Publication Date: 2018/08/22

Vulnerability Publication Date: 2018/08/06