CVE-2011-4929 Command injection in n/a
Remote attackers can execute arbitrary commands on Redmine instances via the bazaar repository adapter, requiring immediate upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-4929?
CVE-2011-4929 is a high-severity command injection vulnerability in Redmine Redmine, published on 8 Oct 2012. It can be exploited over the network, with no action from the victim.
Official description
Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.
Which versions are affected by CVE-2011-4929?
It affects 1 product.
Products include Redmine Redmine.
How do I fix CVE-2011-4929?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2011-4929 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-4929 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Redmine Redmine
Sources
Also known as DEBIAN-CVE-2011-4929, GHSA-w2vv-gmgp-33q7.