high7.5
CVE-2021-45325
Gitea displaying raw OpenID error in UI
Impact
Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/go-gitea/gitea | < 1.7.0 | 1.7.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitea | Gitea | before 1.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.gitea.io/2019/01/gitea-1.7.0-is-released/
- https://github.com/go-gitea/gitea/pull/5705
- https://github.com/advisories/GHSA-8h8p-x289-vvqr
- https://nvd.nist.gov/vuln/detail/CVE-2021-45325
- https://github.com/go-gitea/gitea/issues/4973
- https://github.com/go-gitea/gitea/pull/5712