PT-2015-7520 · Github · Gollum

Shoji Baba · Publicado 2015-10-03 · Atualizado 2018-08-28 · CVE-2015-7314

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions gollum versions prior to 4.0.1

Description The issue allows remote attackers to read arbitrary files due to a lack of a certain temporary-file check in the Precious module.

Recommendations For versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-7314

GHSA-M2Q3-53FQ-7H66

Produtos afetados

Gollum

Referências · 8

• https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1 · Correção
• https://github.com/gollum/gollum · Nota
• https://github.com/gollum/gollum/issues/1070 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN27548431/index.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-7314 · Nota de Segurança
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000149 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/09/22/12 · Nota
• https://osv.dev/vulnerability/GHSA-m2q3-53fq-7h66 · Aviso do Fabricante