Description
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/gogs/gogs/issues/5366
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/go-gitea/gitea/issues/4624
Scores
CVSS v3
8.6
EPSS
0.0210
EPSS Percentile
79.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Details
CWE
CWE-918
Status
published
Products (5)
code.gitea.io/gitea
0 - 1.16.0-rc1Go
gitea/gitea
1.5.0 rc1 (2 CPE variants)
gitea/gitea
< 1.5.0
gogs/gogs
< 0.11.53
gogs.io/gogs
0 - 0.12.0Go
Published
Aug 08, 2018
Tracked Since
Feb 18, 2026