x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-pj96-4jhv-v792

[GoVulnBot]

In GitHub Security Advisory GHSA-pj96-4jhv-v792, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
gogs.io/gogs	0.12.8	< 0.12.8

See doc/triage.md for instructions on how to triage this report.

package: gogs.io/gogs
versions:
  - introduced: v0.0.0
    fixed: v0.12.8
description: |
    ### Impact

    There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.

    ### Patches

    Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

    ### Workarounds

    No need for workarounds.

    ### References

    N/A

    ### For more information

    If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.
published: 2022-06-02T20:46:30Z
last_modified: 2022-06-02T20:46:31Z
ghsas:
  - GHSA-pj96-4jhv-v792

[neild]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/592768 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607219 mentions this issue: data/reports: unexclude 20 reports (17)