CVE-2023-49946

Опубликовано: 03 дек. 2023

Источник: nvd

CVSS3: 9.1

EPSS Низкий

Описание

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

Ссылки

https://about.gitea.com/security
Not Applicable
https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md
Release Notes
Vendor Advisory
https://forgejo.org/2023-11-release-v1-20-5-1/
Release Notes
Vendor Advisory
https://github.com/gogs/gogs/security
Not Applicable
https://about.gitea.com/security
Not Applicable
https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md
Release Notes
Vendor Advisory
https://forgejo.org/2023-11-release-v1-20-5-1/
Release Notes
Vendor Advisory
https://github.com/gogs/gogs/security
Not Applicable

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*

Версия до 1.20.5-1 (исключая)

EPSS

Процентиль: 29%

0.00103

Низкий

9.1 Critical

CVSS3

Дефекты

CWE-732

Связанные уязвимости

CVE-2023-49946

CVSS3: 9.1

debian

около 2 лет назад

In Forgejo before 1.20.5-1, certain endpoints do not check whether an ...

GHSA-fv68-mgcx-47jh

CVSS3: 9.1

github

около 2 лет назад

EPSS

Процентиль: 29%

0.00103

Низкий

9.1 Critical

CVSS3

Дефекты

CWE-732