What is CVE-2022-30781?

CVE-2022-30781 is a high-severity software vulnerability (CWE-116) with a CVSS score of 7.5. Gitea before 1.16.7 does not escape git fetch remote.

Is CVE-2022-30781 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 88%.

Tracked products affected include Gitea. Check the version you run to see whether it is affected.

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

HIGH severity · CVSS 7.5 · CWE-116

7.5CVSS HIGH

Gitea before 1.16.7 does not escape git fetch remote.

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)88%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apply the vendor fix promptly. Open any affected product above for its exact safe version.