CVE-2008-5517 Command injection in n/a
Remote attackers can execute arbitrary commands on the server via shell metacharacters in the gitweb web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-5517?
CVE-2008-5517 is a high-severity command injection vulnerability in n/a, published on 13 Jan 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object.
Weakness: CWE-94
Which versions are affected by CVE-2008-5517?
It affects 1 product.
Products include Git Git.
How do I fix CVE-2008-5517?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2008-5517 being exploited?
There is no known exploitation of CVE-2008-5517 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2024-32002 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
- CVE-2024-52005 The sideband payload is passed unfiltered to the terminal in git
- CVE-2008-3546 Memory corruption in n/a
- CVE-2006-0477 Memory corruption in n/a
- CVE-2009-2108 Denial of service in n/a
Sources
Also known as GHSA-9mgx-58pm-mc68.