github - ghsa-cf6v-9j57-v6r6

ghsa-cf6v-9j57-v6r6

Vulnerability from github

Published

2023-07-05 15:30

Modified

2023-07-06 20:43

Severity ?

3.0 (Low) - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Summary

code.gitea.io/gitea Open Redirect vulnerability

Details

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most likely a post-auth redirect plus it is a POST based request scenario, so less likely that can be exploited or chained with other bugs that can cause phishing or credential theft.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-3515"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T20:43:52Z",
    "nvd_published_at": "2023-07-05T15:15:09Z",
    "severity": "LOW"
  },
  "details": "Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most likely a post-auth redirect plus it is a POST based request scenario, so less likely that can be exploited or chained with other bugs that can cause phishing or credential theft.",
  "id": "GHSA-cf6v-9j57-v6r6",
  "modified": "2023-07-06T20:43:52Z",
  "published": "2023-07-05T15:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3515"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202312-13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "code.gitea.io/gitea Open Redirect vulnerability"
}

cve-2023-3515

Vulnerability from cvelistv5

Published

2023-07-05 14:12

Modified

2025-02-13 16:55

Severity ?

3.0 (Low) - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Summary

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.

References

▼	URL	Tags
	https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053
	https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2
	https://security.gentoo.org/glsa/202312-13

Impacted products

	Vendor	Product	Version
	go-gitea	go-gitea/gitea	Version: unspecified < 1.19.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:55:03.595Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202312-13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-gitea/gitea",
          "vendor": "go-gitea",
          "versions": [
            {
              "lessThan": "1.19.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-23T11:06:17.795Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "url": "https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053"
        },
        {
          "url": "https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2"
        },
        {
          "url": "https://security.gentoo.org/glsa/202312-13"
        }
      ],
      "source": {
        "advisory": "e335cd18-bc4d-4585-adb7-426c817ed053",
        "discovery": "EXTERNAL"
      },
      "title": "Open Redirect in go-gitea/gitea"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2023-3515",
    "datePublished": "2023-07-05T14:12:33.673Z",
    "dateReserved": "2023-07-05T14:12:20.176Z",
    "dateUpdated": "2025-02-13T16:55:48.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted