go-gitea/gitea · Security
Gitea vulnerable to Argument Injection
- GHSA ID
- GHSA-w8xw-7crf-h23x
- CVE ID
- CVE-2022-42968
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.
CWEs
- CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')