CVE-2013-4489 — Improper Input Validation in Gitlab

CWE-20 — Improper Input Validation5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 57.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedMay 17
Latest updateMay 17

Description

The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages3 packages

▶NVDgitlab/gitlab8 versions+7
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

Patches

Patch: www.gitlab.com ↗Patch: www.gitlab.com ↗

🔴Vulnerability Details

2
GHSA
GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed↗2022-05-17
▶
OSV
GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed↗2022-05-17
▶

📋Vendor Advisories

2
GitLab
CVE-2013-4489: The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as de↗2014-05-17
▶
Debian
CVE-2013-4489: gitlab - The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, ...↗2013
▶