Servers and applications
CVE-2020-28991
Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go.
- Severity
- Critical 9.8
- Published
- 24 Nov 2020
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 1.12.6
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
GiteaServers and applications · cpe:a:gitea:gitea |
|