PT-2015-7520 · Github · Gollum

Shoji Baba · Published 2015-10-03 · Updated 2018-08-28 · CVE-2015-7314

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions gollum versions prior to 4.0.1

Description The issue allows remote attackers to read arbitrary files due to a lack of a certain temporary-file check in the Precious module.

Recommendations For versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-7314

GHSA-M2Q3-53FQ-7H66

Affected Products

Gollum

References · 8

• https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1 · Patch
• https://github.com/gollum/gollum/issues/1070 · Vendor Advisory
• http://jvn.jp/en/jp/JVN27548431/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7314 · Security Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2q3-53fq-7h66 · Vendor Advisory
• https://github.com/gollum/gollum · Note
• http://openwall.com/lists/oss-security/2015/09/22/12 · Note