The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Gitea Gitea
cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*
|
— |
28.1.0
|
References 5
https://blog.gitea.com/release-of-28.1.0/
88ee5874-cf24-4952-aea0-31affedb7ff2
https://github.com/go-gitea/gitea/pull/39501
88ee5874-cf24-4952-aea0-31affedb7ff2
https://github.com/go-gitea/gitea/pull/39507
88ee5874-cf24-4952-aea0-31affedb7ff2
https://github.com/go-gitea/gitea/releases/tag/v28.1.0
88ee5874-cf24-4952-aea0-31affedb7ff2
https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq
88ee5874-cf24-4952-aea0-31affedb7ff2