Cyber Resilience

CVE-2022-1058

MediumPublic PoC

Published: 24 March 2022

Published
24 March 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.0308 87.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-1058 is a medium-severity Open Redirect (CWE-601) vulnerability in Gitea Gitea. Its CVSS base score is 6.1 (Medium).

Operationally, ranked in the top 12.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2022-1058 is an open redirect vulnerability (CWE-601) affecting the login flow in the Gitea git service prior to version 1.16.5. The flaw resides in the go-gitea/gitea repository and carries a CVSS 3.1 score of 6.1, reflecting network attackability without authentication but requiring user interaction and resulting in limited confidentiality and integrity impact with changed scope.

An unauthenticated attacker can supply a crafted redirect parameter during the login process to send an authenticated user to an arbitrary external site after successful authentication. This enables phishing or session-token theft scenarios by leveraging the trust users place in the Gitea domain.

The referenced commits (e3d8e92bdc67562783de9a76b5b7842b68daeb48) and associated huntr.dev reports document the corrective changes merged into the 1.16.5 release, indicating that upgrading to a patched version eliminates the redirect logic flaw.

EPSS for the CVE rose from a low baseline to a peak of 0.2627 on 2026-04-02 before receding to the current value of 0.0308, indicating a period of increased exploitation interest after public disclosure.

EU & UK References

Vulnerability details

Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gitea
gitea
≤ 1.16.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-601

Security awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.

addresses: CWE-601

Validates redirect targets and URLs to ensure they conform to allowed destinations.

References