MEDIUM 5.3 Go
Gitea displaying raw OpenID error in UI
GHSA-8h8p-x289-vvqr · BIT-gitea-2021-45325 · CVE-2021-45325 · GO-2022-0308
Published · Modified
Description
Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-45325
- WEB https://github.com/go-gitea/gitea/issues/4973
- WEB https://github.com/go-gitea/gitea/pull/5705
- WEB https://github.com/go-gitea/gitea/pull/5712
- WEB https://blog.gitea.io/2019/01/gitea-1.7.0-is-released
- PACKAGE https://github.com/go-gitea/gitea
Ready to move
Start Securing
Free, no credit card | First findings in minutes