CVE-2021-45330

An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse...

CVE-2021-45331

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-45331

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-45331

The CVE-2021-45331 issue affects Gitea prior to 1.5.0 and is an Authentication Bypass where a malicious user could abuse the TOTP-based 2FA workflow to gain privileges. Root cause is an authentication mechanism flaw that allows submitting a valid TOTP correctly more than once, enabling privilege ...

CVE-2021-45331

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...

CVE-2021-45330

An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse...

CVE-2021-45330

Summary: In Gitea up to 1.15.7, a client-side cookie handling issue leaves sessions reusable on the server, enabling a malicious user to gain privileges. The root cause is inadequate deletion/cleanup of cookies that maintain server-side sessions. Impact is described as privilege gain with high CV...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution. The vulnerability exists because of the reliance on protection mechanism of HTTP permission methods, allowing an attacker to bypass intended access restrictions and to perform the malicious operations remotely...

Open Redirect

github.com/go-gitea/gitea is vulnerable to open redirect. A remote attacker is able to redirect a victim to an untrusted web page by supplying a maliciously crafted URL via admin.go and gain access to confidential information...

GHSA-JRPG-35HW-M4P9 Capture-replay in Gitea

Gitea is a project to help users set up a self-hosted Git service. Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. This could allow a remote malicious user to execute arbitrary code...

GHSA-8H8P-X289-VVQR Gitea displaying raw OpenID error in UI

Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery SSRF vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI...

GHSA-4WP3-8Q92-MH8W Cross Site Request Forgery in Gitea

Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests...

Cross Site Request Forgery in Gitea

Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests...

Capture-replay in Gitea

Gitea is a project to help users set up a self-hosted Git service. Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. This could allow a remote malicious user to execute arbitrary code...

Gitea displaying raw OpenID error in UI

Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery SSRF vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI...

GHSA-36H2-95GJ-W488 Open redirect in Gitea

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs...

Open redirect in Gitea

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs...

PT-2022-12323 · Gitea · Gitea

Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.5.0 Description: The issue allows a malicious user to bypass authentication, potentially gaining privileges. Specifically, it enables the reuse of one-time passwords, including the TOTP code for 2FA, which can be...

Gitea 授权问题漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to an authorization issue in versions prior to 1.5.0, which stems from the application's lack of authentication measures or insufficient authentication strength. An attacker could exploit the...

Gitea 安全漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea suffers from a security vulnerability that stems from a Gitea client-side cookie from 1.15.7 not being deleted and the session remaining valid on the server side for reuse. An attacker can exploit this vulnerabili...