CVE-2011-1572 Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defin...
MediumCVSS 6.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitolite | <= 1.5.9 | No fix listed |
| gitolite | = 0.50 | No fix listed |
| gitolite | = 0.55 | No fix listed |
| gitolite | = 0.60 | No fix listed |
| gitolite | = 0.65 | No fix listed |
| gitolite | = 0.70 | No fix listed |
| gitolite | = 0.80 | No fix listed |
| gitolite | = 0.85 | No fix listed |
| gitolite | = 0.90 | No fix listed |
| gitolite | = 0.95 | No fix listed |
| gitolite | = 1.0 | No fix listed |
| gitolite | = 1.0-rc1 | No fix listed |
| gitolite | = 1.1 | No fix listed |
| gitolite | = 1.2 | No fix listed |
| gitolite | = 1.3 | No fix listed |
| gitolite | = 1.4 | No fix listed |
| gitolite | = 1.4.1 | No fix listed |
| gitolite | = 1.4.2 | No fix listed |
| gitolite | = 1.5 | No fix listed |
| gitolite | = 1.5.1 | No fix listed |
| gitolite | = 1.5.2 | No fix listed |
| gitolite | = 1.5.3 | No fix listed |
| gitolite | = 1.5.4 | No fix listed |
| gitolite | = 1.5.5 | No fix listed |
| gitolite | = 1.5.6 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| gitolite | = 1.5.7 | No fix listed |
| gitolite | = 1.5.8 | No fix listed |
References
- groups.google.com
- [oss-security] 20110409 CVE id request: gitolite mailing-list patch
- [oss-security] 20110411 Re: CVE id request: gitolite mailing-list patch
- DSA-2215 vendor-advisory
- 46473 patch vdb-entry
- bugzilla.redhat.com patch
- gitolite-adc-security-bypass(65542) vdb-entry
- github.com patch