Vulnerability advisory
GHSA-hfmf-q69j-6m5p
Reuse of one time passwords allowed in Gitea
Also known as BIT-gitea-2021-45331CVE-2021-45331GO-2022-0315
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 1.5.0 | 1.5.0 |
Description
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.