Gitolite
by Gitolite
Source repositories
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2013-4451 | Cri | 0.57 | 9.8 | 0.03 | Sep 21, 2018 | gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs. | ||
| CVE-2013-7203 | Med | 0.36 | 5.5 | 0.00 | Sep 21, 2018 | gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup. | ||
| CVE-2010-2447 | 0.00 | — | 0.02 | Nov 7, 2019 | gitolite before 1.4.1 does not filter src/ or hooks/ from path names. | |||
| CVE-2018-20683 | 0.00 | — | 0.02 | Jan 10, 2019 | commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P. | |||
| CVE-2018-16976 | Hig | 0.00 | 8.1 | 0.01 | Sep 12, 2018 | Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended… | ||
| CVE-2012-4506 | 0.00 | — | 0.02 | Oct 22, 2012 | Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name. | |||
| CVE-2011-1572 | 0.00 | — | 0.03 | Oct 4, 2011 | Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands. |
- risk 0.57cvss 9.8epss 0.03
gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.
- risk 0.36cvss 5.5epss 0.00
gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup.
- CVE-2010-2447Nov 7, 2019risk 0.00cvss —epss 0.02
gitolite before 1.4.1 does not filter src/ or hooks/ from path names.
- CVE-2018-20683Jan 10, 2019risk 0.00cvss —epss 0.02
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.
- risk 0.00cvss 8.1epss 0.01
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended…
- CVE-2012-4506Oct 22, 2012risk 0.00cvss —epss 0.02
Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.
- CVE-2011-1572Oct 4, 2011risk 0.00cvss —epss 0.03
Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.