PT-2020-9152 · Giting · Giting

Published 2020-02-28 · Updated 2021-04-13 · CVE-2019-10802

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions giting versions prior to 0.0.8

Description The issue allows execution of arbitrary commands. The first argument repo of function pull() is executed by the package without any validation.

Recommendations For versions prior to 0.0.8, update to version 0.0.8 or later to resolve the issue. As a temporary workaround, consider disabling the pull() function until a patch is available. Restrict access to the repo argument to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-10802

GHSA-53XJ-V576-3CH2

SNYK-JS-GITING-559008

Affected Products

Giting

References · 9

• https://osv.dev/vulnerability/GHSA-53xj-v576-3ch2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10802 · Security Note
• ❌ https://github.com/MangoRaft/git · Note, Deleted
• https://t.me/cibsecurity/10189 · Telegram Post
• https://web.archive.org/web/20201208120654/https://github.com/MangoRaft/git/commit/9be41081f547d3dcef25e7d7c957bc2a3be2dfe0 · Note
• ❌ https://github.com/MangoRaft/git/commit/9be41081f547d3dcef25e7d7c957bc2a3be2dfe0 · Note, Deleted
• https://snyk.io/vuln/SNYK-JS-GITING-559008 · Note
• https://t.me/cvenotify/1293 · Telegram Post