Medium WID-SEC-2024-0945 1 CVE

Gitea: Schwachstelle ermöglicht Codeausführung

Published Apr 22, 2024 · Updated Apr 22, 2024 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gitea ausnutzen, um beliebigen Programmcode auszuführen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 1

High 7.2

CVE-2020-14144 Public exploit Scanner template EPSS 95%

Arbitrary Code Execution in Gitea

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented imme…

code.gitea.io/gitea Go

Oct 16, 2020

Revision history

2024-04-22 #1
Initiale Fassung

References

GitHub Advisory Database vom 2024-04-22
https://github.com/advisories/GHSA-3h6c-c475-jm7v
NIST Vulnerability Database vom 2024-04-22
https://nvd.nist.gov/vuln/detail/CVE-2020-14144
Beschreibung des Exploits
https://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.html