CVE-2022-0905

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...

CVE-2022-0905

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...

Authorization

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...

CVE-2022-0905

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...

CVE-2022-0905 Missing Authorization in go-gitea/gitea

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...

PT-2022-13517 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: gitea versions prior to 1.16.4 Description: The issue concerns missing authorization in the gitea repository. This allows for improper authorization, potentially leading to unauthorized access. A patch is available as part of the 1.16.4...

Gitea 授权问题漏洞

Gitea is a project to set up a self-hosted Git service. Gitea suffers from an authorization error vulnerability that stems from PAM authentication when building and configuring Gitea, which skips checking authorization altogether and can be exploited by attackers to log into expired accounts and...

CVE-2022-0905

CVE-2022-0905 concerns Gitea (go-gitea/gitea) prior to 1.16.4, with a missing/Improper Authorization vulnerability in PAM/auth flow. Affected component is the Gitea login/authorization path where PAM authentication can skip authorization checks, enabling login for expired accounts or accounts wit...

Exploit for OS Command Injection in Gitea

CVE-2020-14144 - GiTea authenticated RCE A script to explo...

Improper Authorization

Description When Gitea is build and configured for PAM authentification it skips checking authorization completely. Therefore expired accounts and accounts with expired passwords can still login. Proof of Concept You can expire an account with chage -E0 and still login. Impact Since disabling an...

gitea -- Improper/incorrect authorization

Youssef Rebahi-Gilbert reports: When Gitea is built and configured for PAM authentication it skips checking authorization completely. Therefore expired accounts and accounts with expired passwords can still login...

Gitea Exposes Private Email Addresses

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

Gitea Improper Input Validation

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Specific Go Packages Affected github.com/go-gitea/gitea/models...

Gitea Remote Code Execution

models/repomirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution...

GHSA-Q47X-6MQQ-4W92 Gitea Improper Input Validation

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Specific Go Packages Affected github.com/go-gitea/gitea/models...

GHSA-HF6F-JQ25-8GQ9 Gitea Remote Code Execution (RCE)

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

GHSA-F5FJ-7265-JXHJ Gitea Exposes Private Email Addresses

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

Gitea Remote Code Execution (RCE)

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

GHSA-HPMR-PRR2-CQC4 Gitea Remote Code Execution

models/repomirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution...

GHSA-G2QX-6GHW-67HM Denial of Service in Gitea

An issue was discovered in Gitea in which an attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another...