CVE-2021-28378
MEDIUM 5.4EPSS 8.8%
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
- CVSS v3.1 NVD
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS v3.1 MITRE
- 3.7 LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS v2.0 NVD
- 3.5 LOW
AV:N/AC:M/Au:S/C:N/I:P/A:N - EPSS
- 8.76% chance of exploitation in the next 30 days, 95th percentile
- Published
- 2021-03-15
- Updated
- 2024-08-03
Proof-of-concept exploits (1)
- pandatix/CVE-2021-283784★ · 2026-01-09
Security advisories
- https://blog.gitea.io/2021/03/gitea-1.13.4-is-released
- PandatiX/CVE-2021-28378
- go-gitea/gitea/pull/14898
- advisories/GHSA-g95p-88p4-76cm