Open-source package vulnerability · Go
CVE-2020-28991: Improper Access Control in Gitea
criticalCVSS 3.1 9.8GHSA-r7h7-chh4-5rvm
Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repoform.go.
Published Apr 24, 2024
Affected packages
github.com/go-gitea/gitea
- Ecosystem
- Go
- Affected
- >= 0.9.99, < 1.12.6
- Fixed in
- 1.12.6
- Check
go list -m github.com/go-gitea/gitea
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology