x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45326

[GoVulnBot]

In CVE-2021-45326, the reference URL github.com/go-gitea/gitea (and possibly others) refers to something in Go.

• PR: Enforce token on api routes [fixed critical security issue #4357] go-gitea/gitea#4840

module: github.com/go-gitea/gitea
package: n/a
description: |
    Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
cves:
  - CVE-2021-45326
links:
    pr: https://github.com/go-gitea/gitea/pull/4840
    context:
      - https://blog.gitea.io/2018/10/gitea-1.5.2-is-released/
      - https://github.com/go-gitea/gitea/issues/4838

See doc/triage.md for instructions on how to triage this report.

[neild]

This appears to be a vulnerability in a binary, not a user-imported package.

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607215 mentions this issue: data/reports: unexclude 20 reports (13)