- Description
- The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.
- Source
- 88ee5874-cf24-4952-aea0-31affedb7ff2
- NVD status
- Analyzed
- Products
- gitea
CVSS 3.1
- Type
- Secondary
- Base score
- 6.1
- Impact score
- 2.7
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
- 88ee5874-cf24-4952-aea0-31affedb7ff2
- CWE-79
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A392C59B-D9D1-41C2-BBEC-C0E388C35439",
"versionEndExcluding": "28.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]