CVE-2024-6886 Inproper Sanitation of field leading to stored XSS
An attacker can inject malicious scripts into Gitea fields, leading to stored XSS that may compromise user sessions or execute code in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-6886?
CVE-2024-6886 is a critical cross-site scripting vulnerability in Gitea Open Source Git Server, published on 6 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
Weakness: CWE-79
Which versions are affected by CVE-2024-6886?
3 open source packages ship an affected version, including code.gitea.io/gitea.
| Package | Affected | Fixed in |
|---|---|---|
code.gitea.io/gitea Go | All versions | 1.22.1 |
code.gitea.io/gitea Go | All versions | 1.22.1 |
code.gitea.io/gitea Go | All versions | 1.22.1 |
How do I fix CVE-2024-6886?
Upgrade code.gitea.io/gitea to 1.22.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-6886 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6886 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-4h4p-553m-46qh, GO-2024-3056.