CVE-2018-17031

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2018-09-14

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Gogs (Gogs)

References

• https://github.com/gogs/gogs/issues/5397