CVE-2019-11576: Gitea Allows 1FA Even for 2FA-Enrolled Accounts

May 24, 2022 (updated April 24, 2024)

Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user’s credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.

References

blog.gitea.io/2019/04/gitea-1.8.0-is-released
github.com/advisories/GHSA-3393-r4p5-vhqh
github.com/go-gitea/gitea
github.com/go-gitea/gitea/pull/6674
github.com/go-gitea/gitea/pull/6676
nvd.nist.gov/vuln/detail/CVE-2019-11576

Code Behaviors & Features

Detect and mitigate CVE-2019-11576 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →