CVE-2024-39931

Gogs through 0.13.0 allows deletion of internal files

Critical · published July 4, 2024

Patch now

High probability of exploitation

CVSS calls it critical at 9.9. It sits in the 99.0th percentile for exploit probability.

CVSS v3.1
9.9
EPSS
53%
Percentile
99.0
In the wild
Unconfirmed
What it is

⚠️ A single deletion request can wipe critical internal files in Gogs v0.13.0, exposing you to chaos! 🔥 Think of it like a restaurant where the chef can accidentally demolish the entire pantry with one wrong order — it’s a recipe for disaster! An attacker could gain access to your Gogs instance and delete vital files, potentially crippling your project and causing havoc. This is absolutely devastating for any organization relying on Gogs for version control, as it impacts both data integrity and workflow. Don’t let a simple command turn into a catastrophic situation!

Put simply

Think of it like a restaurant where the chef can accidentally demolish the entire pantry with one wrong order — it’s a recipe for disaster! This vulnerability allows unauthorized deletion of internal files in Gogs, enabling malicious users to remove important data without proper authorization checks in place.

What to do

An attacker could gain access to your Gogs instance and delete vital files, potentially crippling your project and causing havoc. This is absolutely devastating for any organization relying on Gogs for version control, as it impacts both data integrity and workflow. Don’t let a simple command turn into a catastrophic situation! Patch immediately to the latest version of Gogs to mitigate this risk. Review user permissions and restrict access to critical functions to prevent unintentional deletions. Regular backups are also essential to recover any lost data quickly. You've got this! By taking these steps, you'll be well on your way to securing your Gogs instance. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.52658 · 99.0th percentile
Published
2024-07-04T00:00Z
EPSS history
Timeline
  • 04 JUL 00:00Z
    Gogs through 0.13.0 allows deletion of internal files
    cvelistv5