PT-2022-6563 · Gitea+1 · Gitea+1

Zeripath · Published 2019-01-31 · Updated 2024-08-21 · CVE-2021-45325

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.7.0

Description A Server Side Request Forgery (SSRF) issue exists, allowing a remote attacker to exploit the vulnerability using a specially crafted OpenID URL. This can lead to sensitive information about the local network being leaked through the error provided by the UI.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the OpenID URL to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2019-1153

BDU:2023-02418

BIT-GITEA-2021-45325

CVE-2021-45325

GHSA-8H8P-X289-VVQR

GO-2022-0308

Affected Products

Alt Linux

Gitea

References · 16

• https://github.com/go-gitea/gitea/pull/5705 · Patch
• https://blog.gitea.io/2019/01/gitea-1.7.0-is-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45325 · Security Note
• https://osv.dev/vulnerability/GHSA-8h8p-x289-vvqr · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45325 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02418 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45325 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-45325 · Security Note
• https://osv.dev/vulnerability/GO-2022-0308 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45325 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2021-45325 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/issues/4973 · Note
• https://github.com/go-gitea/gitea/pull/5712 · Note
• https://t.me/cibsecurity/37015 · Telegram Post