Cross-site scripting in Gitea - CVE-2019-1010314
Published: July 11, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU35725
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-1010314
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Gitea
Gitea
Software vendor:
The Gitea Authors
The Gitea Authors
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.
Remediation
Install update from vendor's website.