« Volver al listado

CVE-2019-11228

Estado: ModificadaAlta (7.5)—

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitea — Gitea

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-11228",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-04-15T12:31:36.603",
  "references": [
    {
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.7.6",
      "tags": [
        "Patch",
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3",
      "tags": [
        "Patch",
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.7.6",
      "tags": [
        "Patch",
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3",
      "tags": [
        "Patch",
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress."
    },
    {
      "lang": "es",
      "value": "Versiones anteriores a 1.7.6 y 1.8.x anteriores a 1.8-RC3 de repo/setting.go en Gitea no validan form.MirrorAddress antes de invocar SaveAddress."
    }
  ],
  "lastModified": "2026-06-17T02:12:34.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "864A4420-67DF-445F-8D5C-11D3F64E0165",
              "versionEndExcluding": "1.7.6"
            },
            {
              "criteria": "cpe:2.3:a:gitea:gitea:1.8.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0927D13C-5565-456B-B6D9-E2D10C8D8878"
            },
            {
              "criteria": "cpe:2.3:a:gitea:gitea:1.8.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7661CD1-D457-40B4-8674-BA622EF01EC6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}