CVE-2024-6886

🗓️ 06 Aug 2024 03:23:21Reported by GiteaType

cve🔗 web.nvd.nist.gov👁 107 Views🌐 WEB

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Open Source Git Serve

Reporter	Title	Published	Views	Family All 22
0day.today	Gitea 1.22.0 - Stored XSS Vulnerability	28 Aug 202400:00	–	zdt
BDU FSTEC	The vulnerability of the Git repository management system Gitea arises from the lack of measures taken to protect the structure of the web page. This allows attackers to carry out cross-site scripting attacks.	16 Aug 202400:00	–	bdu_fstec
Circl	CVE-2024-6886	6 Aug 202407:28	–	circl
CNNVD	Gitea 跨站脚本漏洞	6 Aug 202400:00	–	cnnvd
Cvelist	CVE-2024-6886 Inproper Sanitation of field leading to stored XSS	6 Aug 202403:23	–	cvelist
Exploit DB	Gitea 1.22.0 - Stored XSS	28 Aug 202400:00	–	exploitdb
EUVD	EUVD-2024-2490	3 Oct 202520:07	–	euvd
Github Security Blog	Gitea Cross-site Scripting Vulnerability	6 Aug 202406:30	–	github
GitLab Advisory Database	Gitea Cross-site Scripting Vulnerability	6 Aug 202400:00	–	gitlab
Nuclei	Gitea 1.22.0 - Cross-Site Scripting	10 Jun 202605:11	–	nuclei

[
  {
    "defaultStatus": "unaffected",
    "product": "Gitea Open Source Git Server",
    "repo": "https://github.com/go-gitea/gitea/",
    "vendor": "Gitea",
    "versions": [
      {
        "status": "affected",
        "version": "1.22.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
blog	www.blog.gitea.com/release-of-1.22.1/
github	www.github.com/go-gitea/gitea/pull/31200

Parameter	Position	Path	Description	CWE
description	request body	/{username}/{repo_name}/settings	Stored XSS via repository Description field in settings. Malicious payload injected into description is stored and executed in another user's session.	CWE-79

15 Apr 2026 00:35Current

6.5Medium risk

Vulners AI Score6.5

CVSS 410

EPSS0.25195

SSVC

CWE-79