CVE-2017-17536 Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a bran...
HighCVSS 8.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with a --config= or --debugger= substring.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/phabricator(Debian:12) | All versions | No fix listed |
| debian/phabricator(Debian:12) | = 0~git20220903-2 | No fix listed |
| phacility phabricator | < 2017-11-10 | 2017-11-10 |
References
- Debian Security Tracker CVE-2017-17536 vendor-advisory
- hackerone.com issue-tracking third-party-advisory
- secure.phabricator.com issue-tracking patch vendor-advisory