1. Home
  2. CVE Database
  3. CVE-2022-38183
MEDIUM · 6.5

CVE-2022-38183

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permissi...

Vulnerability Description

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
GiteaGitea< 1.16.9

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2022-38183?

CVE-2022-38183 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permissi...

How severe is CVE-2022-38183?

CVE-2022-38183 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-38183?

Check the references section above for vendor advisories and patch information. Affected products include: Gitea Gitea.