« Volver al listado

CVE-2019-1010314

Estado: ModificadaMedia (6.1)—

Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitea — Gitea

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-1010314",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "josh@bress.net",
      "affectedData": [
        {
          "vendor": "Gitea",
          "product": "Gitea",
          "versions": [
            {
              "status": "affected",
              "version": "1.7.2, 1.7.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-11T20:15:12.037",
  "references": [
    {
      "url": "https://github.com/go-gitea/gitea/releases",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "josh@bress.net"
    },
    {
      "url": "https://github.com/go-gitea/gitea/releases",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page."
    },
    {
      "lang": "es",
      "value": "Gitea versiones 1.7.2, 1.7.3 está afectada por: Cross Site Scripting (XSS). El impacto es: ejecutar JavaScript en el navegador de la víctima, cuando la página repo vulnerable es cargada. El componente es: descripción del repositorio. El vector de ataque es: la víctima debe navegar en la página repo pública y afectada."
    }
  ],
  "lastModified": "2026-06-17T02:09:58.573",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitea:gitea:1.7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C8887C0-FE62-42B2-BF01-21DB9548A80B"
            },
            {
              "criteria": "cpe:2.3:a:gitea:gitea:1.7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4C163C-7718-4457-9FCE-9EE1B547BAE7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "josh@bress.net"
}