GitHub Advisoryadvisory · Go

GHSA-8h8p-x289-vvqr Gitea displaying raw OpenID error in UI

MEDIUM Published 2022-02-09 Modified 2022-02-14 Official page ↗
Aliases
CVE-2021-45325
Ecosystem
Go
Packages
github.com/go-gitea/gitea
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-02-14

Affected packages

• Go github.com/go-gitea/gitea: < 1.7.0 → fixed in 1.7.0

Description

Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI.

Related

Alias · CVE (1)

  • CVE-2021-45325 Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References