PT-2022-24262 · Gitea+1 · Gitea+1

Christian Pöschl · Published 2022-07-28 · Updated 2024-06-10 · CVE-2022-38183

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.16.9

Description The issue is related to improper access controls in Gitea, allowing an attacker to assign any issue to any project. This results in the attacker gaining access to private issue titles due to the lack of permission checks for fetching issues.

Recommendations For versions prior to 1.16.9, update to version 1.16.9 or later to resolve the issue. As a temporary workaround, consider restricting access to project issue assignment until the update is applied.

Fix

Incorrect Permission

Missing Authorization

Weakness Enumeration

CWE-732

CWE-862

Related Identifiers

ALT-PU-2022-2311

ALT-PU-2022-2358

ALT-PU-2022-3074

BIT-GITEA-2022-38183

CVE-2022-38183

GHSA-FHV8-M4J4-CWW2

GO-2024-2769

Affected Products

Alt Linux

Gitea

References · 18

• https://osv.dev/vulnerability/GHSA-fhv8-m4j4-cww2 · Vendor Advisory
• https://blog.gitea.io/2022/07/gitea-1.16.9-is-released · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-38183 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38183 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-14 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38183 · Security Note
• https://osv.dev/vulnerability/BIT-gitea-2022-38183 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-38183 · Security Note
• https://osv.dev/vulnerability/GO-2024-2769 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/pull/20196 · Note
• https://github.com/go-gitea/gitea/pull/20133 · Note
• https://t.me/cibsecurity/48106 · Telegram Post
• https://herolab.usd.de/security-advisories/usd-2022-0015 · Note