Published: 03/08/2018 Updated: 02/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

cgit_clone_objects in CGit prior to 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cgit project cgit
debian debian linux 9.0
debian debian linux 8.0

Debian Bug report logs - #905382 cgit: CVE-2018-14912: directory traversal vulnerability Package: src:cgit; Maintainer for src:cgit is Debian cgit Maintainers <team+cgit@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 3 Aug 2018 20:21:01 UTC Severity: grave Tags: patch, security ...

Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' (default) is not turned off For the stable distribution (stretch), this problem has been f ...

cgit_clone_objects in CGit before 121 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgitcgi/git/objects/?path=/ request ...

# Title: cgit 121 - Directory Traversal (Metasploit) # Author: Dhiraj Mishra # Software: cgit # Link: gitzx2c4com/cgit/ # Date: 2018-08-14 # CVE: CVE-2018-14912 # This module exploits a directory traversal vulnerability which exists # in cgit < 121 cgit_clone_objects(), reachable when the configuration # flag enable-http-clone is ...

cgit suffers from a directory traversal vulnerability in cgit_clone_objects() ...

CWE-22 https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html https://bugs.chromium.org/p/project-zero/issues/detail?id=1627 https://www.debian.org/security/2018/dsa-4263 https://lists.debian.org/debian-lts-announce/2018/08/msg00005.html https://www.exploit-db.com/exploits/45195/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=905382 https://nvd.nist.gov https://www.exploit-db.com/exploits/45195/https://www.debian.org/security/./dsa-4263

CVE-2018-14912

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect