GitHub Advisoryadvisory · Go

GHSA-r7h7-chh4-5rvm Improper Access Control in Gitea

CRITICAL Published 2024-04-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2020-28991
Ecosystem
Go
Packages
github.com/go-gitea/gitea
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2024-04-24

Affected packages

• Go github.com/go-gitea/gitea: >= 0.9.99, < 1.12.6 → fixed in 1.12.6

Description

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go.

Related

Alias · CVE (1)

  • CVE-2020-28991 Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References