CVE-2020-14144

CVE Enrichment

CVSS: 7.2 HIGH
EPSS: 95.36%
EPSS Percentile: 99.87%
CISA KEV: Not listed

Description

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 16-Oct-2020 21:15
Last Modified: 17-Jun-2026 09:54
EPSS Date: 2026-10-16
CWE: CWE-78

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:H /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

gitea / gitea
Version / affected range: * · from (inclusive) 1.1.0 · through (inclusive) 1.12.5
cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*

References

Last enrichment sync: 18-Oct-2026 08:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

to post-authentication remote code execution (RCE) due to an insecure default vulnerability (CVE-2020-14144), but there are multiple prerequisites for exploitation: in versions 1.1.0 through 1.12.5, the flag JINX-0132 Exploits Exposed DevOps Tools to Deploy XMRig Cryptominers

CVE (1)

Malware (1)

Threat Actors (1)

MITRE ATT&CK (4)

Vendors (2)

Products (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.