Arbitrary Code Execution in Gitea
The git hook feature in Gitea 1.1.0 through 1.12.5 allows for authenticated remote code execution.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-14144US | high7.2 | Exploit | ||
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., on… | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.htmlWEB
- https://docs.github.com/en/enterprise-server%402.19/admin/policies/creating-a-pre-receive-hook-scriptWEB
- https://docs.github.com/en/enterprise-server@2.19/admin/policies/creating-a-pre-receive-hook-scriptWEB
- https://docs.gitlab.com/ee/administration/server_hooks.htmlWEB
- https://github.com/PandatiX/CVE-2021-28378WEB
- https://github.com/PandatiX/CVE-2021-28378#notesWEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/8fe8ab5cbf2977f3a01ea12361df2cd76dce3ea9WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan