PT-2012-5475 · Cgit+1 · Cgit+1

Kurt Seifried · Publicado 2012-11-11 · Atualizado 2024-06-15 · CVE-2012-4548

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cgit versions 9.0.3 and earlier

Description The issue allows remote authenticated users with permissions to add files to execute arbitrary commands. This is achieved via the --plug-in argument to the highlight command in the syntax-highlighting.sh script.

Recommendations For versions 9.0.3 and earlier, consider disabling the highlight command or restricting access to the syntax-highlighting.sh script until a patch is available. As a temporary workaround, avoid using the --plug-in argument in the highlight command to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2012-4548

OPENSUSE-SU-2012_1460-1

OPENSUSE-SU-2012_1461-1

OPENSUSE-SU-2024:10137-1

Produtos afetados

Suse

Cgit

Referências · 29

• https://lists.opensuse.org/archives/list/[e-mail]/thread/H5NXWFBJGNGXXVTCJMPPWQACIWW4T2QP · Nota
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00004.html · Aviso do Fabricante
• http://secunia.com/advisories/51167 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-2711 · Nota
• https://suse.com/security/cve/CVE-2016-1901 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4548 · Nota
• https://suse.com/security/cve/CVE-2012-4548 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00022.html · Aviso do Fabricante
• https://bugzilla.novell.com/787074 · Nota
• https://suse.com/security/cve/CVE-2016-1899 · Nota
• http://secunia.com/advisories/50734 · Aviso do Fabricante
• http://support.novell.com/security/cve/CVE-2012-4548.html · Nota
• http://openwall.com/lists/oss-security/2012/10/28/2 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10137-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-2117 · Nota