CVE-2012-4506 Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories a...
MediumCVSS 4.6
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitolite | = 3.0 | No fix listed |
| gitolite | = 3.02 | No fix listed |
| gitolite | = 3.03 | No fix listed |
| gitolite | = 3.04 | No fix listed |
| sitaram chamarty gitolite | = 3.01 | No fix listed |
References
- 50896 third-party-advisory vendor-advisory
- [oss-security] 20121009 CVE Request: gitolite path traversal vulnerability mailing-list
- [oss-security] 20121009 Re: CVE Request: gitolite path traversal vulnerability mailing-list
- 55853 vdb-entry
- gitolite-security-bypass(79130) vdb-entry
- github.com
- groups.google.com