Описание
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.
Ссылки
- Release Notes
- Issue TrackingPatch
- Issue TrackingPatch
- Release Notes
- Broken Link
Уязвимые конфигурации
Конфигурация 1Версия до 1.25.4 (исключая)
cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*
EPSS
Процентиль: 7%
0.00026
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-284
Связанные уязвимости
CVSS3: 6.5
debian
16 дней назад
Gitea's stopwatch API does not re-validate repository access permissio ...
github
16 дней назад
Gitea improperly exposes issue titles and repository names through previously started stopwatches
EPSS
Процентиль: 7%
0.00026
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-284