CVE-2020-14144Not scoredCWE-78

CVE-2020-14144: Gitea 1.1.0 - 1.12.5 - Remote Code Execution

Gitea

Affected: Gitea · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

95.4%probability of exploitation in the next 30 days

99th percentile

050100

Higher than 99% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: Gitea 1.1.0 - 1.12.5 - Remote Code Execution · nuclei template in projectdiscovery/nuclei-templates
Weakness: OS Command Injection · Command and Code Injection
Vendor: Gitea
Published: October 2020
Band: Check available, not yet exploited, October 2020

CoverageNo articles yet

No CyberSIXT article names CVE-2020-14144 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.