PT-2023-25169 · Gitea+1 · Gitea+1

Lafriks · Published 2023-07-05 · Updated 2024-08-20 · CVE-2023-3515

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gitea versions prior to 1.19.4

Description The issue is an Open Redirect vulnerability in the GitHub repository go-gitea/gitea. This vulnerability is most likely a post-auth redirect and is a POST-based request scenario, making it less likely to be exploited or chained with other bugs for phishing or credential theft.

Recommendations For versions prior to 1.19.4, update to version 1.19.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable redirect functionality until a patch is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2023-4568

ALT-PU-2023-4588

ALT-PU-2024-3792

BIT-GITEA-2023-3515

CVE-2023-3515

GHSA-CF6V-9J57-V6R6

GO-2023-1894

Affected Products

Alt Linux

Gitea

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3515.json · Exploit
• 🔥 https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053 · Exploit
• https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2 · Patch
• https://osv.dev/vulnerability/CVE-2023-3515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3515 · Security Note
• https://osv.dev/vulnerability/GHSA-cf6v-9j57-v6r6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2023-3515 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1894 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://security.gentoo.org/glsa/202312-13 · Note
• https://t.me/cvenotify/54069 · Telegram Post
• https://github.com/advisories/GHSA-cf6v-9j57-v6r6 · Note
• https://t.me/cvenotify/65036 · Telegram Post
• https://t.me/cibsecurity/65977 · Telegram Post