Vulnerabilities > CVE-2013-4582 - Inclusion of Functionality from Untrusted Control Sphere vulnerability in Gitlab and Gitlab-Shell

CVSS 4.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

gitlab

CWE-829

NVD

Published: 2020-01-28

Updated: 2020-02-04

Summary

The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.

Vulnerable Configurations

Part	Description	Count
Application	Gitlab Gitlab Gitlab 5.0.0 Gitlab Gitlab 5.0.1 Gitlab Gitlab 5.1.0 Gitlab Gitlab 5.2.0 Gitlab Gitlab 5.2.1 Gitlab Gitlab 5.3.0 Gitlab Gitlab 5.4.0 Gitlab Gitlab 5.4.1 Gitlab Gitlab 6.0.0 Gitlab Gitlab 6.0.1 Gitlab Gitlab 6.0.2 Gitlab Gitlab 6.1.0 Gitlab Gitlab 6.2.0 Gitlab Gitlab 6.2.1 Gitlab Gitlab 6.2.2 Gitlab Gitlab 6.2.3 Gitlab Gitlab Shell 1.0.4 Gitlab Gitlab Shell 1.1.0 Gitlab Gitlab Shell 1.2.0 Gitlab Gitlab Shell 1.3.0 Gitlab Gitlab Shell 1.4.0 Gitlab Gitlab Shell 1.5.0 Gitlab Gitlab Shell 1.6.0 Gitlab Gitlab Shell 1.7.0 Gitlab Gitlab Shell 1.7.1 Gitlab Gitlab Shell 1.7.2 Gitlab Gitlab Shell 1.7.3 Gitlab Gitlab Shell 1.7.4 Gitlab Gitlab Shell 1.7.5 Gitlab Gitlab Shell 1.7.6 Gitlab Gitlab Shell 1.7.7	48

Common Weakness Enumeration (CWE)

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References