CVE-2012-4548 Command injection in n/a

Medium 6.0 Published 11 Nov 2012 Updated 6 Aug 2024

Authenticated users can execute arbitrary commands via argument injection in the syntax highlighting script.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2012-4548?

CVE-2012-4548 is a medium-severity command injection vulnerability in n/a, published on 11 Nov 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command.

Which versions are affected by CVE-2012-4548?

It affects 1 product.

Products include Lars Hjemli Cgit.

How do I fix CVE-2012-4548?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2012-4548 being exploited?

There is no known exploitation of CVE-2012-4548 in the wild and no public exploit code.

Sources

Also known as GHSA-cwx8-vfpp-jm78.