{"id":"CVE-2022-1058","published":"2022-03-24T14:15:12Z","modified":"2024-08-02T23:47:43Z","title":"Open Redirect on login in go-gitea/gitea","vendor":"go-gitea","product":"go-gitea/gitea","tier":"tail","description":{"text":"Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.53177,"percentile":0.98977,"provenance":"source"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/go-gitea/gitea/commit/e3d8e92bdc67562783de9a76b5b7842b68daeb48","tags":["x_refsource_MISC"]}],"priority":{"score":29.8,"factors":[{"name":"EPSS percentile","points":19.8},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.04}]},"exploitSources":{"nuclei":[{"id":"CVE-2022-1058","name":"Gitea <1.16.5 - Open Redirect","severity":"medium","path":"http/cves/2022/CVE-2022-1058.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1058.yaml"}],"provenance":"source"},"vendorSlug":"go-gitea","affectedVersions":[{"vendor":"go-gitea","product":"go-gitea/gitea","versions":[">= unspecified, < 1.16.5"]}],"affected":[{"ecosystem":"Go","package":"code.gitea.io/gitea","vulnerableRanges":["<1.16.5"],"patched":["1.16.5"],"from":["GHSA-4rqq-rxvc-v2rc","GO-2024-2752"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1315","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-15192","published":"2018-08-08","fixed":"1.16.0-rc1","kev":false},{"cve":"CVE-2022-0905","published":"2022-03-10","fixed":"1.16.4","kev":false,"link":{"from":"CVE-2022-0905","to":"CVE-2022-1058","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:code.gitea.io/gitea","fromFixed":"1.16.4","toFixed":"1.16.5","daysApart":14}]}},{"cve":"CVE-2022-27313","published":"2022-05-03","fixed":"1.16.4","kev":false},{"cve":"CVE-2022-1058","published":"2022-03-24","fixed":"1.16.5","kev":false},{"cve":"CVE-2022-30781","published":"2022-05-16","fixed":"1.16.7","kev":false,"link":{"from":"CVE-2022-1058","to":"CVE-2022-30781","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:code.gitea.io/gitea","fromFixed":"1.16.5","toFixed":"1.16.7","daysApart":53}]}},{"cve":"CVE-2022-1928","published":"2022-05-29","fixed":"1.16.9","kev":false},{"cve":"CVE-2022-38183","published":"2022-08-12","fixed":"1.16.9","kev":false}],"package":"Go:code.gitea.io/gitea"}}