CVE-2022-30781

high-risk
Published 2022-05-16

Gitea before 1.16.7 does not escape git fetch remote.

Do I need to act?

!
80.7% chance of exploitation in next 30 days
EPSS score — higher than 19% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
51009
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Gitea

References (10)

Exploit http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.h...
Exploit http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Executio...
Release Notes https://blog.gitea.io/2022/05/gitea-1.16.7-is-released/
Patch https://github.com/go-gitea/gitea/pull/19487
Patch https://github.com/go-gitea/gitea/pull/19490
Exploit http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.h...
Exploit http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Executio...
Release Notes https://blog.gitea.io/2022/05/gitea-1.16.7-is-released/
Patch https://github.com/go-gitea/gitea/pull/19487
Patch https://github.com/go-gitea/gitea/pull/19490
58
/ 100
high-risk
Severity 26/34 · High
Exploitability 27/34 · High
Exposure 5/34 · Minimal