CVE-2022-1058
Published: 24 March 2022
Summary
CVE-2022-1058 is a medium-severity Open Redirect (CWE-601) vulnerability in Gitea Gitea. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 12.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-1058 is an open redirect vulnerability (CWE-601) affecting the login flow in the Gitea git service prior to version 1.16.5. The flaw resides in the go-gitea/gitea repository and carries a CVSS 3.1 score of 6.1, reflecting network attackability without authentication but requiring user interaction and resulting in limited confidentiality and integrity impact with changed scope.
An unauthenticated attacker can supply a crafted redirect parameter during the login process to send an authenticated user to an arbitrary external site after successful authentication. This enables phishing or session-token theft scenarios by leveraging the trust users place in the Gitea domain.
The referenced commits (e3d8e92bdc67562783de9a76b5b7842b68daeb48) and associated huntr.dev reports document the corrective changes merged into the 1.16.5 release, indicating that upgrading to a patched version eliminates the redirect logic flaw.
EPSS for the CVE rose from a low baseline to a peak of 0.2627 on 2026-04-02 before receding to the current value of 0.0308, indicating a period of increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1315
Vulnerability details
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.