CVEvulnerability

CVE-2018-1000803

5.3 MEDIUM Published 2018-10-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-10-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.

Affected configurations

• gitea gitea (< 1.5.1)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References