GHSA-cf6v-9j57-v6r6

code.gitea.io/gitea Open Redirect vulnerability

En bref

Publiée: 2023-07-05 15:30 UTC
Mise à jour: 2026-09-10 03:49 UTC
CVE: CVE-2023-3515
Alias: BIT-gitea-2023-3515, GO-2023-1894
CVSS_V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Description

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most likely a post-auth redirect plus it is a POST based request scenario, so less likely that can be exploited or chained with other bugs that can cause phishing or credential theft.

Paquets affectés

Paquet	Versions
Go · code.gitea.io/gitea	introduced 0, fixed 1.19.4

Références

https://nvd.nist.gov/vuln/detail/CVE-2023-3515 ADVISORY
https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2 WEB
https://github.com/go-gitea/gitea PACKAGE
https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053 WEB
https://security.gentoo.org/glsa/202312-13 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database