CVE-2019-1010261: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 24, 2022 (updated July 14, 2023)

Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.

References

github.com/advisories/GHSA-5rh7-6gfj-mc87
github.com/go-gitea/gitea/pull/5905
nvd.nist.gov/vuln/detail/CVE-2019-1010261

Code Behaviors & Features

Detect and mitigate CVE-2019-1010261 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →