CVE-2018-1000803

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-1000803

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000803.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-1000803

Aliases

Published

2018-10-08T15:29:00.367Z

Modified

2026-08-07T14:54:00.132996Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.

References

Affected packages

Git / github.com/go-gitea/gitea

Affected ranges

Type

GIT

Repo

https://github.com/go-gitea/gitea

Events

Introduced

Fixed

38d8b8cf49ce62dd7cfc806f1995d00e6fecc707

Database specific

Show details

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.1"
        }
    ]
}

Affected versions

v0.*

v0.9.99

v1.*

v1.0.0

v1.1.0

v1.5.0

v1.5.0-dev

v1.5.0-rc1

v1.5.0-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000803.json"