x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-cf6v-9j57-v6r6

[GoVulnBot]

In GitHub Security Advisory GHSA-cf6v-9j57-v6r6, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
code.gitea.io/gitea	1.19.4	< 1.19.4

Cross references:

• Module code.gitea.io/gitea appears in issue x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-jr9c-h74f-2v28 #609 EFFECTIVELY_PRIVATE
• Module code.gitea.io/gitea appears in issue x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-ph3w-2843-72mx #612 EFFECTIVELY_PRIVATE
• Module code.gitea.io/gitea appears in issue x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-g95p-88p4-76cm #832 NOT_IMPORTABLE
• Module code.gitea.io/gitea appears in issue x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-hf6f-jq25-8gq9 #844 NOT_IMPORTABLE
• Module code.gitea.io/gitea appears in issue x/vulndb: potential Go vuln in code.gitea.io/gitea: CVE-2021-45330, GHSA-pg38-r834-g45j #982 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: code.gitea.io/gitea
      versions:
        - fixed: 1.19.4
      vulnerable_at: 1.19.3
      packages:
        - package: code.gitea.io/gitea
summary: code.gitea.io/gitea Open Redirect vulnerability
description: |-
    Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most
    likely a post-auth redirect plus it is a POST based request scenario, so less
    likely that can be exploited or chained with other bugs that can cause phishing
    or credential theft.
cves:
    - CVE-2023-3515
ghsas:
    - GHSA-cf6v-9j57-v6r6
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-3515
    - fix: https://github.com/go-gitea/gitea/commit/9aaaf980f0ba15611f30568bd67bce3ec12954e2
    - web: https://huntr.dev/bounties/e335cd18-bc4d-4585-adb7-426c817ed053
    - advisory: https://github.com/advisories/GHSA-cf6v-9j57-v6r6

[gopherbot]

Change https://go.dev/cl/508456 mentions this issue: data/excluded: batch add 14 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606787 mentions this issue: data/reports: unexclude 20 reports (7)