PT-2020-7388 · Viewgit · Viewgit

Matthew R. Bucci · Published 2020-01-30 · Updated 2020-01-31 · CVE-2013-2294

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: ViewGit versions prior to 0.0.7

Description: The issue allows remote repository users to inject arbitrary web script or HTML via a tag name to the Shortlog table in templates/shortlog.php or branch name to the Shortlog table in templates/shortlog.php or the Heads table in plates/summary.php. This is due to multiple cross-site scripting (XSS) vulnerabilities.

Recommendations: For versions prior to 0.0.7, update to version 0.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the templates/shortlog.php and plates/summary.php files to minimize the risk of exploitation. Avoid using user-supplied input for tag names and branch names in the affected tables until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-2294

Affected Products

Viewgit

References · 7

• 🔥 http://seclists.org/fulldisclosure/2013/Mar/174 · Exploit
• 🔥 http://packetstormsecurity.com/files/120862/ViewGit-0.0.6-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/24862 · Exploit
• 🔥 http://exploit-db.com/exploits/24862 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2294 · Security Note
• http://freecode.com/projects/viewgit/releases/353086 · Note
• https://t.me/cvenotify/676 · Telegram Post