PT-2007-1721 · Gforge · Gforge

Published 2007-05-29 · Updated 2017-07-29 · CVE-2007-0246

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GForge versions prior to 4.5.16 (20070524)

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH INFO of the cvsweb.php file in the CVSWeb CGI.

Recommendations For versions prior to 4.5.16 (20070524), update to a version released after 20070524 to resolve the issue.

Fix

Related Identifiers

CVE-2007-0246

DSA-1297-1

Affected Products

Gforge

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-0246 · Security Note
• http://debian.org/security/2007/dsa-1297 · Vendor Advisory
• http://secunia.com/advisories/25395 · Vendor Advisory
• http://secunia.com/advisories/25416 · Vendor Advisory
• http://securityfocus.com/bid/24141 · Note
• http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/plugins/scmcvs/www/cvsweb.php?root=gforge&r1=5849&r2=6038&pathrev=6038 · Note
• http://vupen.com/english/advisories/2007/1942 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34510 · Note
• http://osvdb.org/36526 · Note