CVE-2021-45327 — Interpretation Conflict in Gitea

CWE-436 — Interpretation ConflictCWE-294 — Authentication Bypass by Capture-replay5 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.9%
top 24.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Code.gitea.io GiteaGithub.com Go-gitea GiteaGitea
Timeline
PublishedFeb 8
Latest updateAug 21

Description

Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Gocode.gitea.io/gitea< 1.11.2
▶NVDgitea/gitea< 1.11.2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Capture-replay in Gitea in code.gitea.io/gitea↗2024-08-21
▶
GHSA
Capture-replay in Gitea↗2022-02-09
▶
OSV
Capture-replay in Gitea↗2022-02-09
▶
OSV
CVE-2021-45327: Gitea before 1↗2022-02-08
▶