6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
Bernhard R. Link discovered that the CVS browsing interface of Gforge, a
collaborative development tool, performs insufficient escaping of URLs,
which allows the execution of arbitrary shell commands with the privileges
of the www-data user.
The oldstable distribution (sarge) is not affected by this problem.
For the stable distribution (etch) this problem has been fixed in
version 4.5.14-5etch1.
For the unstable distribution (sid) this problem has been fixed in
version 4.5.14-6.
We recommend that you upgrade your gforge-plugin-scmcvs package.
CPE | Name | Operator | Version |
---|---|---|---|
gforge-plugin-scmcvs | eq | 4.5.14-5 |