x/vulndb: potential Go vuln in github.com/gotify/server: CVE-2022-46181

[GoVulnBot]

CVE-2022-46181 references github.com/gotify/server, which may be a Go module.

Description:
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts if another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the ./image directory.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-46181
• JSON: https://github.com/CVEProject/cvelist/tree/2cb5bf92d16baccd93f831c896cc34b61cea7df9/2022/46xxx/CVE-2022-46181.json
• web: GHSA-xv6x-456v-24xh
• fix: Fix file upload XSS gotify/server#534
• fix: Only serve image files on ./image gotify/server#535
• Imported by: https://pkg.go.dev/github.com/gotify/server?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/gotify/server
    packages:
      - package: server
description: |
    Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
cves:
  - CVE-2022-46181
references:
  - web: https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh
  - fix: https://github.com/gotify/server/pull/534
  - fix: https://github.com/gotify/server/pull/535

[gopherbot]

Change https://go.dev/cl/460419 mentions this issue: data/excluded: batch add GO-2022-1253, GO-2022-1251, GO-2022-1250, GO-2022-1248, GO-2022-1245, GO-2022-1243, GO-2022-1240, GO-2022-1239, GO-2022-1236, GO-2022-1235, GO-2022-1225, GO-2022-1220, GO-2022-1219, GO-2022-1218, GO-2022-1216, GO-2022-1208, GO-2022-1206, GO-2022-1204, GO-2022-1200, GO-2022-1192, GO-2022-1190, GO-2022-1189, GO-2022-1258, GO-2022-1226, GO-2022-1214, GO-2022-1210, GO-2022-1212

[gopherbot]

Change https://go.dev/cl/592835 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607232 mentions this issue: data/reports: unexclude 20 reports (30)