DeutschShown in its original language — a full translation is planned for a future version.
Gitea: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
view advisory published 2023-05-08
Ein entfernter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-29400US | high7.3 | — | ||
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normaliz… | ||||
| CVE-2023-24540US | critical9.8 | — | ||
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029"… | ||||
| CVE-2023-24539US | high7.3 | — | ||
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpe… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2023-3319 vom 2023-05-26external
- Red Hat Security Advisory RHSA-2023:3318 vom 2023-05-25external
- Red Hat Security Advisory RHSA-2023:3319 vom 2023-05-25external
- Red Hat Security Advisory RHSA-2023:3323 vom 2023-05-25external
- Red Hat Security Advisory RHSA-2023:3379 vom 2023-06-03external
- Red Hat Security Advisory RHSA-2023:3415 vom 2023-06-01external
- Red Hat Security Advisory RHSA-2023:3435 vom 2023-06-05external
- Red Hat Security Advisory RHSA-2023:3445 vom 2023-06-06external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan