/Vulnerability Library

Gitea < 1.4.3 - Open Redirect

CVE-2021-45328
Verified

Description

Gitea before version 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. The vulnerability exists in the redirect_to parameter used on the login page (/user/login). Due to improper validation of the redirect URL, an attacker can craft a malicious link that redirects authenticated users to an arbitrary external website after login.

Severity

Medium

CVSS Score

6.1

Exploit Probability

1%

Affected Product

gitea

Published Date

March 31, 2023

Template Author

ritikchaddha

CVE-2021-45328.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2021-45328
CWE ID:
cwe-601

References

https://github.com/go-gitea/gitea/issues/4332https://nvd.nist.gov/vuln/detail/CVE-2021-45328

Remediation Steps

Upgrade Gitea to version 1.4.3 or later to fix the open redirect vulnerability.