CVE-2019-11229
Gitea ≤ 1.7.6
Public PoCHigh EPSS
Published
15 April 2019
Modified
21 November 2024
CVSS Score v3.1
8.8
Click a component to see what it means
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.56
99th percentile
Summary
CVE-2019-11229 is a high-severity an unspecified weakness vulnerability in Gitea Gitea. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1053
Vulnerability Data
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability is in a public-facing web application (Gitea) and allows remote code execution via malicious mirror repository URL settings.
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Remote code execution achieved through the vulnerability enables arbitrary command execution on the server.
inferred from description · MITRE ATT&CK Enterprise v19.0
CVEs Like This One
CVE-2025-68941Same product: Gitea Gitea
CVE-2026-20912Same product: Gitea Gitea
CVE-2025-69413Same product: Gitea Gitea
CVE-2025-68943Same product: Gitea Gitea
CVE-2025-68945Same product: Gitea Gitea
CVE-2025-68946Same product: Gitea Gitea
CVE-2026-20736Same product: Gitea Gitea
CVE-2026-20883Same product: Gitea Gitea
CVE-2025-68942Same product: Gitea Gitea
CVE-2025-68944Same product: Gitea Gitea
Affected Assets
gitea
gitea
1.8.0 · ≤ 1.7.6
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.