CVE-2011-1572

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.

Weaknesses (CWE)

CWE-22

Affected Products (27)

gitolite · gitolitevulnerable

References (16)

http://groups.google.com/group/gitolite/browse_thread/thread/797a93ec26e1dcbc?pli=1

http://seclists.org/oss-sec/2011/q2/197

Patch

http://seclists.org/oss-sec/2011/q2/209

Patch

http://www.debian.org/security/2011/dsa-2215

http://www.securityfocus.com/bid/46473

Patch

https://bugzilla.redhat.com/show_bug.cgi?id=695568

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/65542

https://github.com/sitaramc/gitolite/commit/4ce00aef84d1ff7c35f7adbbb99a6241cfda00cc

Patch

http://groups.google.com/group/gitolite/browse_thread/thread/797a93ec26e1dcbc?pli=1

http://seclists.org/oss-sec/2011/q2/197

Patch

http://seclists.org/oss-sec/2011/q2/209

Patch

http://www.debian.org/security/2011/dsa-2215

http://www.securityfocus.com/bid/46473

Patch

https://bugzilla.redhat.com/show_bug.cgi?id=695568

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/65542

https://github.com/sitaramc/gitolite/commit/4ce00aef84d1ff7c35f7adbbb99a6241cfda00cc

Patch