{"id":"CVE-2019-11576","published":"2019-04-28T01:40:48Z","modified":"2024-08-04T22:55:40Z","title":"Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment","vendor":null,"product":null,"tier":"tail","description":{"text":"Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01766,"percentile":0.77917,"provenance":"source"},"cwes":[],"references":[{"url":"https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/","tags":["x_refsource_MISC"]},{"url":"https://github.com/go-gitea/gitea/pull/6674","tags":["x_refsource_MISC"]}],"priority":{"score":15.6,"factors":[{"name":"EPSS percentile","points":15.58}]},"affected":[{"ecosystem":"Go","package":"code.gitea.io/gitea","vulnerableRanges":["<1.8.0"],"patched":["1.8.0"],"from":["GHSA-3393-r4p5-vhqh"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2093","exploited":false,"provenance":"source"}}