CVE-2020-9708CWE-24

GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function

Medium · published August 14, 2020

CVSS v3.1
5.9
EPSS
3%
Percentile
87.0
In the wild
Unconfirmed
What it is

The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of the repository.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02942 · 87.0th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2020-08-14T16:48Z
EPSS history
Timeline
  • 14 AUG 16:48Z
    GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function
    cvelistv5