CVE-2023-49947

EUVD-2023-53842
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 16%
Affected Products (NVD)
VendorProductVersion
forgejoforgejo
𝑥
< 1.20.5-1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://codeberg.org/forgejo/forgejo/commit/44df78edd40076b349d50dc5fb02af417a44cfab
https://forgejo.org/2023-11-release-v1-20-5-1/
https://codeberg.org/forgejo/forgejo/commit/44df78edd40076b349d50dc5fb02af417a44cfab
https://forgejo.org/2023-11-release-v1-20-5-1/