Lucene search

Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-17B29209B78AA1EDD8C9303E5AC95949

HistoryDec 03, 2023 - 12:00 a.m.

Incorrect Permission Assignment for Critical Resource

2023-12-0300:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

forgejo

permission assignment

critical resource

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.8%

JSON

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

Affected configurations

Vulners

Node

goforgejoRange<1.20.5-1

CPENameOperatorVersion
go/codeberg.org/forgejo/forgejolt1.20.5-1

CPE	Name	Operator	Version
	go/codeberg.org/forgejo/forgejo	lt	1.20.5-1

References

about.gitea.com/security

codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md

forgejo.org/2023-11-release-v1-20-5-1/

github.com/gogs/gogs/security

nvd.nist.gov/vuln/detail/CVE-2023-49946

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.8%

JSON

Related for GITLAB-17B29209B78AA1EDD8C9303E5AC95949