{"id":"CVE-2021-45325","aliases":["BIT-gitea-2021-45325","EUVD-2022-0918","GHSA-8h8p-x289-vvqr","GO-2022-0308","UBUNTU-CVE-2021-45325"],"status":"published","title":"Gitea displaying raw OpenID error in UI","description":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01049,"percentile":0.64713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2022-02-08T14:36:14Z","modified":"2026-10-27T02:45:05Z","fixes":[{"ecosystem":"Go","package":"github.com/go-gitea/gitea","fixed_in":["1.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"gitea","fixed_in":["1.7.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-gitea/gitea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-gitea/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-gitea/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-code.gitea-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20170710.0.fc63966-1","0.0~git20170919.0.cdb43f0-1","0.0~git20171222.4ec3654-1","0.0~git20171222.4ec3654-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-code.gitea-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20170708.0.9990008-1","0.0~git20170920.0.60c6048-1","0.0~git20171220.79eee8f-1","0.0~git20171220.79eee8f-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-code.gitea-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20171222.4ec3654-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-code.gitea-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20171220.79eee8f-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-code.gitea-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20190411.63b74d4+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-code.gitea-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20171220.79eee8f-3"]}],"products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://blog.gitea.io/2019/01/gitea-1.7.0-is-released/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://github.com/go-gitea/gitea/pull/5705","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45325","tags":["web","advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/4973","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/pull/5712","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-8h8p-x289-vvqr","tags":["advisory"]},{"url":"https://blog.gitea.io/2019/01/gitea-1.7.0-is-released","tags":["web"]},{"url":"https://github.com/go-gitea/gitea","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-45325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45325","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-45325","description":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.","status":"published","published":"2022-02-08T14:36:14Z","modified":"2024-08-04T04:39:20.458Z","updated_at":"2026-11-02T14:33:02.20241Z"}],"euvd":[{"id":"EUVD-2022-0918","description":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.","status":"published","published":"2022-02-08T14:36:14Z","modified":"2024-08-04T04:39:20Z","updated_at":"2026-11-03T03:08:27.448176Z"}],"ghsa":[{"id":"GHSA-8h8p-x289-vvqr","title":"Gitea displaying raw OpenID error in UI","description":"Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI. ","status":"published","published":"2022-02-09T00:00:29Z","modified":"2023-02-03T05:05:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:36:42.703723Z"}],"nvd":[{"id":"CVE-2021-45325","description":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.","status":"published","published":"2022-02-08T15:15:07.727Z","modified":"2026-06-17T04:13:15.943Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:04.178977Z"}],"osv":[{"id":"CVE-2021-45325","description":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.","status":"published","published":"2022-02-08T15:15:07.727Z","modified":"2026-10-27T02:45:05.387913823Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"GHSA-8h8p-x289-vvqr","title":"Gitea displaying raw OpenID error in UI","description":"Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI. ","status":"published","published":"2022-02-09T00:00:29Z","modified":"2024-08-21T14:56:54.323548Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"UBUNTU-CVE-2021-45325","description":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.","status":"published","published":"2022-02-08T15:15:00Z","modified":"2025-10-24T04:50:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"BIT-gitea-2021-45325","description":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.","status":"published","published":"2024-03-06T10:54:55.605Z","modified":"2026-09-08T08:47:32.737938074Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"GO-2022-0308","title":"Gitea displaying raw OpenID error in UI in github.com/go-gitea/gitea","description":"Gitea displaying raw OpenID error in UI in github.com/go-gitea/gitea","status":"published","published":"2024-08-21T14:30:26Z","modified":"2026-03-03T04:52:06.663844Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}