Описание
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
A flaw was found in Gitea. An incomplete fix for a previous vulnerability allowed any authenticated user to enumerate all members of a private organization through the /members API endpoint. This information disclosure could expose sensitive details about an organization's internal structure and personnel to unauthorized individuals.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Pipelines | openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9 | Affected |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-359
https://bugzilla.redhat.com/show_bug.cgi?id=2515456gitea.dev: Gitea: Information disclosure of private organization member lists
EPSS
Процентиль: 27%
0.00342
Низкий
6.5 Medium
CVSS3
Связанные уязвимости
CVSS3: 7.5
nvd
20 дней назад
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
github
около 1 месяца назад
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
EPSS
Процентиль: 27%
0.00342
Низкий
6.5 Medium
CVSS3