Two-Factor Authentication Bypass in Forgejo by Codethink
CVE-2023-49947

7.5HIGH

Key Information:

Vendor

Forgejo

Status
Forgejo
Vendor
CVE Published:
3 December 2023

What is CVE-2023-49947?

A serious vulnerability in Forgejo prior to version 1.20.5-1 allows attackers to bypass two-factor authentication when using Basic Authentication for Docker login. This flaw creates a significant security risk, as it enables unauthorized access to sensitive data and functionalities, making it imperative for users to update to the latest version to mitigate potential threats.

References

https://forgejo.org/2023-11-release-v1-20-5-1/
https://codeberg.org/forgejo/forgejo/commit/44df78edd4007...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2023-49947 : Two-Factor Authentication Bypass in Forgejo by Codethink