BIT-gitea-2022-38183

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/gitea/BIT-gitea-2022-38183.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-gitea-2022-38183
Aliases
Published
2024-03-06T10:52:48.810Z
Modified
2024-06-10T17:13:53.704450Z
Summary
[none]
Details

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

Database specific
{
    "cpes": [
        "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / gitea

Package

Name
gitea
Purl
pkg:bitnami/gitea

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.16.9