PT-2022-20656 · Gitblit · Gitblit

Published 2022-05-21 · Updated 2022-06-02 · CVE-2022-31268

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitblit version 1.9.3

Description A Path Traversal issue allows reading website files via the "/resources//../" endpoint, potentially followed by a WEB-INF or META-INF pathname. This could lead to unauthorized access to sensitive information.

Recommendations For Gitblit version 1.9.3, consider restricting access to the /resources/ endpoint until a patch is available. As a temporary workaround, avoid using the /resources//../ path to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-31268

GHSA-2C65-RQ62-FQHQ

Affected Products

Gitblit

References · 6

• 🔥 https://github.com/metaStor/Vuls/blob/main/gitblit/gitblit%20V1.9.3%20path%20traversal/gitblit%20V1.9.3%20path%20traversal.md · Exploit
• https://osv.dev/vulnerability/GHSA-2c65-rq62-fqhq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31268 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31268 · Vendor Advisory
• https://github.com/gitblit/gitblit · Note
• https://t.me/cvenotify/30541 · Telegram Post