CVE-2013-1423 Path traversal in n/a
Local attackers can exploit symlink or hard link vulnerabilities in FusionForge to modify file permissions and access sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1423?
CVE-2013-1423 is a medium-severity path traversal vulnerability in n/a, published on 12 Mar 2013. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
(1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_dump_update.pl, (5) deb-specific/ssh_dump_update.pl, (6) deb-specific/user_dump_update.pl, (7) plugins/scmbzr/common/BzrPlugin.class.php, (8) plugins/scmcvs/common/CVSPlugin.class.php, (9) plugins/scmcvs/cronjobs/cvs.php, (10) plugins/scmcvs/cronjobs/ssh_create.php, (11) plugins/scmgit/common/GitPlugin.class.php, (12) plugins/scmsvn/common/SVNPlugin.class.php, (13) plugins/wiki/cronjobs/create_groups.php, (14) utils/cvs1/cvscreate.sh, and (15) utils/include.pl in FusionForge 5.0, 5.1, and 5.2 allows local users to change arbitrary file permissions, obtain sensitive information, and have other unspecified impacts via a (1) symlink or (2) hard link attack on certain files.
Weakness: CWE-59
Which versions are affected by CVE-2013-1423?
It affects 1 product.
Products include Fusionforge Fusionforge.
How do I fix CVE-2013-1423?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2013-1423 being exploited?
There is no known exploitation of CVE-2013-1423 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DSA-2633-1, GHSA-f3gf-w5h5-pc5j.