Lucene search

Veracode Vulnerability DatabaseVERACODE:44561

HistoryDec 04, 2023 - 9:13 a.m.

Authentication Bypass

2023-12-0409:13:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

gitea

authentication bypass

vulnerability

docker login

2fa

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.0%

JSON

gitea is vulnerable to Authentication Bypass. The vulnerability is caused when docker login uses basic authentication, which allows an attacker to bypass 2FA authentication.

CPENameOperatorVersion
code.gitea.io/gitealev1.20.5
codeberg.org/forgejo/forgejolev1.20.5-0
code.gitea.io/gitealev1.20.5
codeberg.org/forgejo/forgejolev1.20.5-0

Name	Operator	Version
code.gitea.io/gitea	le	v1.20.5
codeberg.org/forgejo/forgejo	le	v1.20.5-0
code.gitea.io/gitea	le	v1.20.5
codeberg.org/forgejo/forgejo	le	v1.20.5-0

References

codeberg.org/forgejo/forgejo/commit/44df78edd40076b349d50dc5fb02af417a44cfab

forgejo.org/2023-11-release-v1-20-5-1/

github.com/advisories/GHSA-6vhm-rhmc-3q94

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.0%

JSON

Related for VERACODE:44561