All vulnerabilities

Servers and applications

CVE-2018-15192

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

Severity: High 8.6
Published: 8 Aug 2018
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 1.5.0
Exploit chance: 2.1% in the next 30 daysHigher than 82% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness: Server-side request forgery (CWE-918)
Attack: Over the network · No login needed · No user action needed
Attacker can: Read data
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Sources: NVD

Affected software

Software	Affected versions
GiteaServers and applications · `cpe:a:gitea:gitea`	Every version before 1.5.0 Version 1.5.0-rc1 Version 1.5.0-rc2
GogsServers and applications · `cpe:a:gogs:gogs`	Every version up to 0.11.53

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2018-15192
CVE.org https://www.cve.org/CVERecord?id=CVE-2018-15192