GitHub Advisoryadvisory · Go

GHSA-4wp3-8q92-mh8w Cross Site Request Forgery in Gitea

HIGH Published 2022-02-09 Modified 2023-09-15 Official page ↗
Aliases
CVE-2021-45326
Ecosystem
Go
Packages
github.com/go-gitea/gitea
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-02-14

Affected packages

• Go github.com/go-gitea/gitea: < 1.5.2 → fixed in 1.5.2

Description

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.

Related

Alias · CVE (1)

  • CVE-2021-45326 Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References