PT-2019-12633 · Gridea+1 · Gridea+1

0X2E · Published 2019-05-13 · Updated 2019-05-13 · CVE-2019-12047

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gridea version 0.8.0

Description The issue allows for arbitrary code execution through an XSS vulnerability. This can be achieved by calling the Nodejs module, as demonstrated by the use of child process.exec and the substring <img src=# onerror='eval(new Buffer(.

Recommendations For Gridea version 0.8.0, consider disabling the child process.exec function until a patch is available to prevent arbitrary code execution. Restrict access to the Nodejs module to minimize the risk of exploitation. Avoid using the eval function in the onerror attribute of the img tag until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12047

Affected Products

Gridea

Node.Js

References · 3

• 🔥 https://github.com/getgridea/gridea/issues/105 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12047 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12047 · Vendor Advisory