Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Forgejo records in CISA KEVNo Forgejo vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 41
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0086 · Published 2023-12-03 · No fix listed CWE-732
Priority LOW 34
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00609 · Published 2023-12-03 · No fix listed CWE-863
Priority LOW 26
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00803 · Published 2023-12-03 · No fix listed
