PT-2022-6562 · Gitea · Gitea

Beeonthego + 2 · Published 2022-02-08 · Updated 2024-08-21 · CVE-2021-45326

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.5.2

Description The issue is related to a Cross Site Request Forgery (CSRF) vulnerability in the Gitea Git repository management system interface. This vulnerability can be exploited by a remote attacker to perform a CSRF attack by sending specially crafted POST requests, potentially altering the state of the system. The vulnerability is particularly dangerous with state-altering POST requests.

Recommendations For versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to API routes to minimize the risk of exploitation. Avoid using state-altering POST requests in the affected API routes until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2023-02417

BIT-GITEA-2021-45326

CVE-2021-45326

GHSA-4WP3-8Q92-MH8W

GO-2022-0309

Affected Products

Gitea

References · 16

• https://github.com/go-gitea/gitea/pull/4840 · Patch
• https://blog.gitea.io/2018/10/gitea-1.5.2-is-released · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45326 · Security Note
• https://ubuntu.com/security/CVE-2021-45326 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-45326 · Security Note
• https://osv.dev/vulnerability/BIT-gitea-2021-45326 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45326 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wp3-8q92-mh8w · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02417 · Security Note
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/issues/4838 · Note
• https://vuldb.com/ru/?id.192510 · Note
• https://github.com/advisories/GHSA-4wp3-8q92-mh8w · Note