« Volver al listado

CVE-2018-15192

Estado: ModificadaAlta (8.6)—

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Gitea — GiteaGogs — Gogs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-15192",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-08T02:29:00.273",
  "references": [
    {
      "url": "https://github.com/go-gitea/gitea/issues/4624",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/gogs/gogs/issues/5366",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/go-gitea/gitea/issues/4624",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/gogs/gogs/issues/5366",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Server-Side Request Forgery (SSRF) en webhooks en Gitea hasta la versión 1.5.0-rc2 y Gogs hasta la versión 0.11.53 permite que los atacantes remotos accedan a los servicios de la intranet."
    }
  ],
  "lastModified": "2026-06-17T01:42:12.757",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A245EAFE-88C9-470E-9B7A-F8D32F25E2A2",
              "versionEndExcluding": "1.5.0"
            },
            {
              "criteria": "cpe:2.3:a:gitea:gitea:1.5.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "874A1062-D5F9-4601-9DE0-4D205DF0E29A"
            },
            {
              "criteria": "cpe:2.3:a:gitea:gitea:1.5.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A2A9763-A3D0-447F-8D7E-3E12AB28E6C0"
            },
            {
              "criteria": "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D983AEBA-5615-4545-871A-1C17FC38FA1C",
              "versionEndIncluding": "0.11.53"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}