CVE-2020-14144

gitea

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-14144

Katalog CVE

CVSS 7.2 · High EPSS 95,4%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada gitea. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.

Rincian

Terbit di NVD
16 Oktober 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari)
95,4% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
gitea gitea Versi 1.1.0 hingga 1.12.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.