Cross Site Request Forgery in Gitea

GHSA-4wp3-8q92-mh8w · BIT-gitea-2021-45326 · CVE-2021-45326 · GO-2022-0309

Published Feb 9, 2022 · Modified Aug 21, 2024

Description

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-45326
WEB https://github.com/go-gitea/gitea/issues/4838
WEB https://github.com/go-gitea/gitea/pull/4840
WEB https://blog.gitea.io/2018/10/gitea-1.5.2-is-released
PACKAGE https://github.com/go-gitea/gitea

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes