Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside     the external wiki/issue tracker URL field. (CVE-2021-45329)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside
    the external wiki/issue tracker URL field. (CVE-2021-45329)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside
    the external wiki/issue tracker URL field. (CVE-2021-45329)

  - An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain
    privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
    (CVE-2021-45331)

ID	Name	Product	Family	Type	Severity
262766	Linux Distros Unpatched Vulnerability : CVE-2021-45329	Nessus	Misc.	Local	medium
418454	SCA: security update for github.com/go-gitea/gitea (GHSA-r3gq-wxqf-q4gh)	Tenable Cloud Security	SCA Checks	Local	medium
418454	SCA: security update for github.com/go-gitea/gitea (GHSA-r3gq-wxqf-q4gh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
404677	Alpine: multiple gitea packages: security update to 1.5.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
404677	Alpine: multiple gitea packages: security update to 1.5.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2021-45329

medium

Tenable Plugins

medium

medium

medium

critical

critical