PT-2024-5577 · Gitea · Gitea

Alexandru Postolache + 2 · Published 2024-05-31 · Updated 2025-07-05 · CVE-2024-6886

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Gitea Open Source Git Server version 1.22.0

Description The issue affects Gitea Open Source Git Server due to improper neutralization of input during web page generation, allowing Stored XSS. This can enable a remote attacker to conduct a cross-site scripting attack.

Recommendations For version 1.22.0, upgrade to version 1.23.0 to fix this issue. As a temporary workaround, consider restricting access to sensitive areas of the web application to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-06262

CVE-2024-6886

GHSA-4H4P-553M-46QH

GO-2024-3056

Affected Products

Gitea

References · 14

• https://osv.dev/vulnerability/CVE-2024-6886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6886 · Security Note
• https://osv.dev/vulnerability/GO-2024-3056 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06262 · Security Note
• https://osv.dev/vulnerability/GHSA-4h4p-553m-46qh · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/pull/31200 · Note
• https://github.com/go-gitea/gitea/commit/b6280f4d21309cfae7cc07f74173354c664d5e10 · Note
• https://twitter.com/Hossted_OSS/status/1823010503481815218 · Twitter Post
• https://twitter.com/_kujen5/status/1941512403323342983 · Twitter Post
• https://blog.gitea.com/release-of-1.22.1 · Note
• https://t.me/cvedetector/2525 · Telegram Post
• https://github.com/advisories/GHSA-4h4p-553m-46qh · Note
• https://pkg.go.dev/vuln/GO-2024-3056 · Note