SB2011100402 - Path traversal in gitolite

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011100402

SB2011100402 - Path traversal in gitolite

Published: October 4, 2011 Updated: August 11, 2020

Security Bulletin ID SB2011100402
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2011-1572)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to execute arbitrary commands via . (dot dot) sequences in admin-defined commands.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References