Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitea | Gitea | * | 1.5.4 (excluding) |
| Golang-code.gitea-git | Ubuntu | bionic | * |
| Golang-code.gitea-git | Ubuntu | cosmic | * |
| Golang-code.gitea-git | Ubuntu | disco | * |
| Golang-code.gitea-git | Ubuntu | eoan | * |
| Golang-code.gitea-git | Ubuntu | groovy | * |
| Golang-code.gitea-git | Ubuntu | hirsute | * |
| Golang-code.gitea-git | Ubuntu | impish | * |
| Golang-code.gitea-git | Ubuntu | kinetic | * |
Such a scenario is commonly observed when: