Vulnerabilities > CVE-2013-7392 - Arbitrary Command Execution vulnerability in GitList

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
gitlist
exploit available
NVD
Published: 2014-07-22
Updated: 2014-07-22

Summary

Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/. <a href="http://cwe.mitre.org/data/definitions/77.html" target="_blank">CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'</a>

Vulnerable Configurations

Part Description Count
Application
Gitlist
1

Exploit-Db

  • descriptionGitlist <= 0.4.0 - Remote Code Execution. CVE-2013-7392,CVE-2014-4511,CVE-2014-5023. Remote exploits for multiple platform
    fileexploits/multiple/remote/33929.py
    idEDB-ID:33929
    last seen2016-02-03
    modified2014-06-30
    platformmultiple
    port
    published2014-06-30
    reporterdrone
    sourcehttps://www.exploit-db.com/download/33929/
    titleGitlist <= 0.4.0 - Remote Code Execution
    typeremote
  • descriptionGitlist Unauthenticated Remote Command Execution. CVE-2013-7392,CVE-2014-4511. Remote exploits for multiple platform
    fileexploits/multiple/remote/33990.rb
    idEDB-ID:33990
    last seen2016-02-03
    modified2014-07-07
    platformmultiple
    port80
    published2014-07-07
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/33990/
    titleGitlist Unauthenticated Remote Command Execution
    typeremote

References