models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
{
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:gitea:gitea:1.8.0:rc1:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "1.8.0-rc1"
},
{
"last_affected": "1.8.0-rc1"
}
],
"vendor_product": "gitea:gitea",
"source": "CPE_STRING"
}
]
}{
"cpe": [
"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*",
"cpe:2.3:a:gitea:gitea:1.8.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:gitea:gitea:1.8.0:rc2:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.7.6"
},
{
"introduced": "1.8.0-rc1"
},
{
"last_affected": "1.8.0-rc1"
},
{
"introduced": "1.8.0-rc2"
},
{
"last_affected": "1.8.0-rc2"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING",
"REFERENCES"
]
}