PT-2012-5475 · Cgit+1 · Cgit+1

Kurt Seifried · Published 2012-11-11 · Updated 2024-06-15 · CVE-2012-4548

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cgit versions 9.0.3 and earlier

Description The issue allows remote authenticated users with permissions to add files to execute arbitrary commands. This is achieved via the --plug-in argument to the highlight command in the syntax-highlighting.sh script.

Recommendations For versions 9.0.3 and earlier, consider disabling the highlight command or restricting access to the syntax-highlighting.sh script until a patch is available. As a temporary workaround, avoid using the --plug-in argument in the highlight command to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2012-4548

OPENSUSE-SU-2012_1460-1

OPENSUSE-SU-2012_1461-1

OPENSUSE-SU-2024:10137-1

Affected Products

Suse

Cgit

References · 29

• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00004.html · Vendor Advisory
• http://secunia.com/advisories/51167 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00022.html · Vendor Advisory
• http://secunia.com/advisories/50734 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10137-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00003.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4548 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00021.html · Vendor Advisory
• https://lists.opensuse.org/archives/list/[e-mail]/thread/H5NXWFBJGNGXXVTCJMPPWQACIWW4T2QP · Note
• https://suse.com/security/cve/CVE-2011-2711 · Note
• https://suse.com/security/cve/CVE-2016-1901 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4548 · Note
• https://suse.com/security/cve/CVE-2012-4548 · Note
• https://bugzilla.novell.com/787074 · Note
• https://suse.com/security/cve/CVE-2016-1899 · Note