CVE-2020-14958: Improper Preservation of Permissions

May 18, 2021

In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a “not the owner of the email” check.

References

github.com/advisories/GHSA-4c7m-vv47-7c69
github.com/gogs/gogs/commit/82ff0c5852f29daa5f95d965fd50665581e7ea3c
github.com/gogs/gogs/pull/5988
nvd.nist.gov/vuln/detail/CVE-2020-14958

Code Behaviors & Features

Detect and mitigate CVE-2020-14958 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →