Code Repository Cloning Vulnerability in Gitea by Gitea
CVE-2022-38795

6.5MEDIUM

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
7 August 2023

What is CVE-2022-38795?

In Gitea versions up to 1.17.1, a flaw exists within the repository migration function that allows unauthorized repo cloning. This vulnerability could lead to significant exposure of sensitive repository data, posing a risk to users. Users are advised to upgrade to the latest version, 1.17.2, to mitigate this security issue.

References

https://github.com/go-gitea/gitea/pull/20869
https://github.com/go-gitea/gitea/pull/20892
https://blog.gitea.com/release-of-1.17.2/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2022-38795 : Code Repository Cloning Vulnerability in Gitea by Gitea