CVE-2014-4511

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame…

published July 22, 2014

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.

CVSS
—
EPSS
83%
Percentile
99.7
In the wild
Unconfirmed
What it is

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.82730 · 99.7th percentile
Published
2014-07-22T14:00Z
EPSS history
Timeline
  • 22 JUL 14:00Z
    Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame…
    cvelistv5