« Volver al listado

CVE-2013-4451

Estado: ModificadaCrítica (9.8)—

gitolite con commit con ID fa06a34 hasta la versión 3.5.3 podría permitir que se produzca un impacto no especificado mediante vectores que involucran permisos de edición global cuando se crea (1) ~/.gitolite.rc, (2) ~/.gitolite o (3) ~/repositories/gitolite-admin.git en nuevas instalaciones.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitolite — Gitolite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4451",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-09-21T17:29:00.420",
  "references": [
    {
      "url": "https://github.com/sitaramc/gitolite/commit/3dad4f8e3214d6ab5f71823019a624fa48b055a3",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://groups.google.com/forum/#%21topic/gitolite/Tu1sjaf7A4A/discussion",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2013/10/21/11",
      "tags": [
        "Mailing List",
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.securityfocus.com/bid/63237",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/sitaramc/gitolite/commit/3dad4f8e3214d6ab5f71823019a624fa48b055a3",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/forum/#%21topic/gitolite/Tu1sjaf7A4A/discussion",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2013/10/21/11",
      "tags": [
        "Mailing List",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.securityfocus.com/bid/63237",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs."
    },
    {
      "lang": "es",
      "value": "gitolite con commit con ID fa06a34 hasta la versión 3.5.3 podría permitir que se produzca un impacto no especificado mediante vectores que involucran permisos de edición global cuando se crea (1) ~/.gitolite.rc, (2) ~/.gitolite o (3) ~/repositories/gitolite-admin.git en nuevas instalaciones."
    }
  ],
  "lastModified": "2026-06-16T23:57:15.173",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitolite:gitolite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B212DBCA-10D8-4630-947B-8ABF99452006",
              "versionEndIncluding": "3.5.3",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}