PT-2014-2849 · Redmine · Redmine Git Hosting

Published 2014-12-28 · Updated 2014-12-29 · CVE-2013-4663

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Redmine plugin redmine git hosting (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters. This can be achieved in two ways: (1) by injecting shell metacharacters in the service parameter to the "info/refs" API endpoint, related to the get info refs function, or (2) by injecting shell metacharacters in the reqfile argument to the file exists function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2013-4663

Affected Products

Redmine Git Hosting

References · 2

• 🔥 http://sec-1.com/blog/2013/redmine-git-hosting-plugin-remote-command-execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4663 · Security Note