8.8

CVE-2021-45326

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitea ≫ Gitea Version < 1.5.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.432
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://blog.gitea.io/2018/10/gitea-1.5.2-is-released/
Vendor Advisory
Release Notes
https://github.com/go-gitea/gitea/issues/4838
Third Party Advisory
Issue Tracking
https://github.com/go-gitea/gitea/pull/4840
Patch
Third Party Advisory