Vulnerabilities

TI-2023-27310 CVE-2023-49948 · GHSA-jg89-564w-4gwr

Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user…

LOW 26

Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00803 Published 2023-12-03 No fix listed

TI-2023-27309 CVE-2023-49947 · GHSA-6vhm-rhmc-3q94

LOW 34

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2023-12-03 No fix listed CWE-863

TI-2023-27308 CVE-2023-49946 · GHSA-fv68-mgcx-47jh

MEDIUM 41

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0086 Published 2023-12-03 No fix listed CWE-732