CVE-2019-1010261 — Cross-site Scripting in Gitea

CWE-79 — Cross-site Scripting5 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 50.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Code.gitea.io GiteaGitea
Timeline
PublishedJul 18
Latest updateAug 20

Description

Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDgitea/gitea1.7.0
▶CVEListV5gitea/gitea1.7.0 and earlier [fixed: 1.7.1 and later]

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Gitea XSS Vulnerability in code.gitea.io/gitea↗2024-08-20
▶
OSV
Gitea XSS Vulnerability↗2022-05-24
▶
GHSA
Gitea XSS Vulnerability↗2022-05-24
▶
OSV
CVE-2019-1010261: Gitea 1↗2019-07-18
▶