CVE-2020-15867 Code injection in n/a
Authenticated users can execute arbitrary code via git hooks, potentially escalating privileges if non-admins have hook access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15867?
CVE-2020-15867 is a high-severity code injection vulnerability in n/a, published on 16 Oct 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a "Product UI does not Warn User of Unsafe Actions" issue.
Which versions are affected by CVE-2020-15867?
It affects 1 product.
Products include Gogs Gogs.
How do I fix CVE-2020-15867?
No fix has been published for CVE-2020-15867 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-15867 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-15867 exists.
Public exploit code: 1 Metasploit module and 1 Nuclei template.