Insecure Permissions in Gogs

GHSA-4c7m-vv47-7c69 · CVE-2020-14958 · GO-2022-0788

Published May 18, 2021 · Modified Aug 21, 2024

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-14958
WEB https://github.com/gogs/gogs/pull/5988
WEB https://github.com/gogs/gogs/commit/82ff0c5852f29daa5f95d965fd50665581e7ea3c

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Insecure Permissions in Gogs

Description

References

More Go vulnerabilities

Start Securing