PT-2019-12194 · Bonobo · Bonobo Git Server

Publicado 2019-04-24 · Atualizado 2021-07-21 · CVE-2019-11218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bonobo Git Server versions prior to 6.5.0

Description The issue arises from improper handling of extra parameters in the AccountController, specifically in the User Profile edit functionality. This allows authenticated users to submit additional form parameters and potentially gain application administrator privileges.

Recommendations For versions prior to 6.5.0, update to version 6.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the User Profile edit functionality in the AccountController to prevent potential exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-11218

Produtos afetados

Bonobo Git Server

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-11218 · Aviso do Fabricante
• https://flab.cesnet.cz/advisories/cve-2019-11218 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11218 · Nota de Segurança
• https://bonobogitserver.com/changelog/#version-650 · Nota