Vulnerability · Published Aug 6, 2024 · Assigned by Gitea
CVE-2024-6886Inproper Sanitation of field leading to stored XSS
Critical 10.0
In plain English
A critical-severity cross-site scripting in Gitea Open Source Git Server from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 33.0% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)10.0Critical
Exploit odds (30 days)33.0%top 1.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | code.gitea.io/gitea | 1.22.1 | GHSA-4h4p-553m-46qh |
| Go | code.gitea.io/gitea | 1.22.1 | GO-2024-3056 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea Open Source Git Server | 1.22.0 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H