PT-2014-2849 · Redmine · Redmine Git Hosting

Publicado 2014-12-28 · Atualizado 2014-12-29 · CVE-2013-4663

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Redmine plugin redmine git hosting (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters. This can be achieved in two ways: (1) by injecting shell metacharacters in the service parameter to the "info/refs" API endpoint, related to the get info refs function, or (2) by injecting shell metacharacters in the reqfile argument to the file exists function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2013-4663

Produtos afetados

Redmine Git Hosting

Referências · 2

• 🔥 http://sec-1.com/blog/2013/redmine-git-hosting-plugin-remote-command-execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4663 · Nota de Segurança