CVE-2022-31038

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes `DisplayName` prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
gogs	gogs	< 0.12.9

References

https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caeePatch, Third Party Advisory
https://github.com/gogs/gogs/pull/7009Issue Tracking, Third Party Advisory
https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2Issue Tracking, Third Party Advisory
https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caeePatch, Third Party Advisory
https://github.com/gogs/gogs/pull/7009Issue Tracking, Third Party Advisory
https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2Issue Tracking, Third Party Advisory

Timeline

Published: Jun 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-310395.3Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even CVE-2022-31045.5An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return valu CVE-2022-310406.1Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open For CVE-2022-310416.5Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These CVE-2022-310427.5Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a reque CVE-2022-310437.5Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a re CVE-2022-310447.5Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism CVE-2022-310459.8Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain con CVE-2022-310464.3TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the ex CVE-2022-310476.5TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system CVE-2022-310485.4TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer b CVE-2022-310495.4TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used