CVE-2021-28378

Description

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

How to fix CVE-2021-28378

To remediate CVE-2021-28378, upgrade the affected package to a fixed version below.

• Bitnami/gitea—upgrade to 1.12.7 or later
• Go/code.gitea.io/gitea—upgrade to 1.13.4 or later
• —upgrade to 1.13.4 or later

Is CVE-2021-28378 being exploited?

Moderate — EPSS is 11.8%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (3)

• >= 1.12.0, < 1.12.7, >= 1.13.0, < 1.13.4
• from 0, < 1.13.4
• from 0, < 1.13.4

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-g95p-88p4-76cm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-28378
• PATCHgithub.com/go-gitea/gitea
• WEBblog.gitea.io/2021/03/gitea-1.13.4-is-released
• WEB