CVE-2018-18925 - Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go

Back Back to CVE browser

CRITICAL

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go

Published Nov 4, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 31.13%

Description

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-384

References (1)

https://github.com/gogs/gogs/issues/5469
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://github.com/gogs/gogs/issues/5469		x_refsource_MISCPatchThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 4, 2018

Updated Aug 5, 2024

Reserved Nov 4, 2018

Link CVE-2018-18925

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-18925

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-18925