PT-2022-12323 · Gitea · Gitea

Cezar97 · Published 2022-02-09 · Updated 2024-08-21 · CVE-2021-45331

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.5.0

Description The issue allows a malicious user to bypass authentication, potentially gaining privileges. Specifically, it enables the reuse of one-time passwords, including the TOTP code for 2FA, which can be submitted correctly more than once. This could be exploited through the API endpoint related to authentication, although the exact endpoint is not specified.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the 2FA functionality until the update can be applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-GITEA-2021-45331

CVE-2021-45331

GHSA-HFMF-Q69J-6M5P

GO-2022-0315

Affected Products

Gitea

References · 8

• https://github.com/go-gitea/gitea/pull/3878 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-45331 · Security Note
• https://osv.dev/vulnerability/GO-2022-0315 · Vendor Advisory
• https://blog.gitea.io/2018/08/gitea-1.5.0-is-released · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hfmf-q69j-6m5p · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2021-45331 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45331 · Vendor Advisory
• https://github.com/advisories/GHSA-hfmf-q69j-6m5p · Note