GHSA-4wp3-8q92-mh8w

Cross Site Request Forgery in Gitea

Source: GitHub Advisory Database (reviewed) High CVE-2021-45326

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/go-gitea/gitea	< 1.5.2	1.5.2

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-45326 advisory
https://github.com/go-gitea/gitea/issues/4838 web
https://github.com/go-gitea/gitea/pull/4840 web
https://blog.gitea.io/2018/10/gitea-1.5.2-is-released web
https://github.com/go-gitea/gitea package