CVE-2008-5916 Command injection in n/a
Local repository owners can execute arbitrary commands on the server by modifying the diff.external configuration and triggering a crafted gitweb query.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-5916?
CVE-2008-5916 is a medium-severity command injection vulnerability in n/a, published on 21 Jan 2009. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.
Weakness: CWE-264
Which versions are affected by CVE-2008-5916?
It affects 1 product.
Products include Git Git.
How do I fix CVE-2008-5916?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2008-5916 being exploited?
There is no known exploitation of CVE-2008-5916 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-32002 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
- CVE-2024-52005 The sideband payload is passed unfiltered to the terminal in git
- CVE-2008-5517 Command injection in n/a
- CVE-2008-3546 Memory corruption in n/a
- CVE-2006-0477 Memory corruption in n/a
Sources
Also known as GHSA-52fx-g623-mw3m.