gitolite records
7 published records for vendor gitolite.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 57.1%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-20 Improper Input Validation2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-264 Permissions, Privileges, and Access Controls1
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
7 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
40Plan | CVE-2013-4451No exploit | gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions whengitolite · gitolite · CWE-264 | Critical9.8 | 3.0%Sep 21, 2018 |
40Plan | CVE-2010-2447No exploit | gitolite before 1.4.1 does not filter src/ or hooks/ from path names.gitolite · gitolite · CWE-20 | Critical9.8 | 1.7%Nov 7, 2019 |
33Monitor | CVE-2018-20683No exploit | commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have agitolite · gitolite · CWE-20 | High8.1 | 2.0%Jan 9, 2019 |
32Monitor | CVE-2018-16976No exploit | Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is ingitolite · gitolite · CWE-362 | High8.1 | 1.1%Sep 12, 2018 |
28Monitor | CVE-2011-1572No exploit | Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute gitolite · gitolite · CWE-22 | Medium6.8 | 2.9%Oct 4, 2011 |
22Monitor | CVE-2013-7203No exploit | gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when rugitolite · gitolite · CWE-200 | Medium5.5 | 0.4%Sep 21, 2018 |
19Monitor | CVE-2012-4506No exploit | Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows rgitolite · gitolite · CWE-22 | Medium4.6 | 2.0%Oct 22, 2012 |
- CVE-2013-445140Plan
gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when
CriticalCVSS 9.8No exploitEPSS 3%gitolite · gitoliteSep 21, 2018
- CVE-2010-244740Plan
gitolite before 1.4.1 does not filter src/ or hooks/ from path names.
CriticalCVSS 9.8No exploitEPSS 1%gitolite · gitoliteNov 7, 2019
- CVE-2018-2068333Monitor
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a
HighCVSS 8.1No exploitEPSS 2%gitolite · gitoliteJan 9, 2019
- CVE-2018-1697632Monitor
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in
HighCVSS 8.1No exploitEPSS 1%gitolite · gitoliteSep 12, 2018
- CVE-2011-157228Monitor
Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute
MediumCVSS 6.8No exploitEPSS 2%gitolite · gitoliteOct 4, 2011
- CVE-2013-720322Monitor
gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when ru
MediumCVSS 5.5No exploitEPSS 0%gitolite · gitoliteSep 21, 2018
- CVE-2012-450619Monitor
Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows r
MediumCVSS 4.6No exploitEPSS 2%gitolite · gitoliteOct 22, 2012