PT-2023-25169 · Gitea+1 · Gitea+1

Lafriks · Publicado 2023-07-05 · Atualizado 2024-08-20 · CVE-2023-3515

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gitea versions prior to 1.19.4

Description The issue is an Open Redirect vulnerability in the GitHub repository go-gitea/gitea. This vulnerability is most likely a post-auth redirect and is a POST-based request scenario, making it less likely to be exploited or chained with other bugs for phishing or credential theft.

Recommendations For versions prior to 1.19.4, update to version 1.19.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable redirect functionality until a patch is applied.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

ALT-PU-2023-4568

ALT-PU-2023-4588

ALT-PU-2024-3792

BIT-GITEA-2023-3515

CVE-2023-3515

GHSA-CF6V-9J57-V6R6

GO-2023-1894

Produtos afetados

Alt Linux

Gitea

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3515.json · Exploit
• 🔥 https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053 · Exploit
• https://github.com/go-gitea/gitea · Nota
• https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2 · Correção
• https://security.gentoo.org/glsa/202312-13 · Nota
• https://osv.dev/vulnerability/CVE-2023-3515 · Aviso do Fabricante
• https://t.me/cvenotify/54069 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3515 · Nota de Segurança
• https://github.com/advisories/GHSA-cf6v-9j57-v6r6 · Nota
• https://t.me/cvenotify/65036 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-cf6v-9j57-v6r6 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-gitea-2023-3515 · Aviso do Fabricante
• https://t.me/cibsecurity/65977 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-1894 · Aviso do Fabricante