CVE-2007-0246 plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH_I...
MediumCVSS 6.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH_INFO.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gforge | <= 4.5.16 | No fix listed |
References
- gforge.org
- 36526 vdb-entry
- 25395 patch third-party-advisory vendor-advisory
- 25416 patch third-party-advisory vendor-advisory
- DSA-1297 vendor-advisory
- 24141 vdb-entry
- ADV-2007-1942 vdb-entry
- gforge-cvsweb-command-execution(34510) vdb-entry