CVE-2019-11576: Critical severity gitea vulnerability
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-11576?
CVE-2019-11576 is a vulnerability in Gitea before version 1.8.0 that allows 1FA for user accounts that have completed 2FA enrollment.
How does CVE-2019-11576 work?
If a user's credentials are known, an attacker could send them to the Gitea API without requiring the 2FA one-time password.
What is the severity of CVE-2019-11576?
CVE-2019-11576 has a severity rating of 9.8 (Critical).
How can I fix CVE-2019-11576?
To fix CVE-2019-11576, upgrade Gitea to version 1.8.0 or newer.
Where can I find more information about CVE-2019-11576?
You can find more information about CVE-2019-11576 in the following references: [Link 1](https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/), [Link 2](https://github.com/go-gitea/gitea/pull/6674).