CVE-2022-1884
CVSS 3.1 Score 10 of 10 (high)
Details
Published Nov 15, 2024
CWE ID 78
Summary
CVE-2022-1884 is a remote command execution vulnerability that affects gogs/gogs versions below 0.12.8 when deployed on Windows servers. The flaw stems from insufficient validation of the `tree_path` parameter during file uploads. An attacker can exploit this vulnerability by uploading a file into the `.git` directory with a `tree_path=.git.` setting. If the `core.sshCommand` configuration option is enabled, this action allows an attacker to write or rewrite the `.git/config` file, potentially leading to remote command execution.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Gogs