GHSA-8h8p-x289-vvqr
Gitea displaying raw OpenID error in UI
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/go-gitea/gitea | < 1.7.0 | 1.7.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI.
References
External links from the advisory. They lead to third-party sites.