This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Gitlab First view 2014-05-12
Product Gitlab-Shell Last view 2020-01-28
Version Type
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:a:gitlab:gitlab-shell:1.4.0:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.2.0:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.7.1:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.7.0:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.6.0:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.5.0:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.0.4:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.3.0:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.1.0:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.7.2:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:*:*:*:*:*:*:*:* 5
cpe:2.3:a:gitlab:gitlab-shell:1.7.3:*:*:*:*:*:*:* 4
cpe:2.3:a:gitlab:gitlab-shell:1.7.6:*:*:*:*:*:*:* 3
cpe:2.3:a:gitlab:gitlab-shell:1.7.5:*:*:*:*:*:*:* 3
cpe:2.3:a:gitlab:gitlab-shell:1.7.4:*:*:*:*:*:*:* 3

Related : CVE

  Date Alert Description
8.8 2020-01-28 CVE-2013-4583

The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories.

6.5 2020-01-28 CVE-2013-4582

The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.

6.5 2014-05-13 CVE-2013-4546

The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL.

6.5 2014-05-13 CVE-2013-4490

The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.

6.8 2014-05-12 CVE-2013-4581

GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbitrary code via a crafted change using SSH.

CWE : Common Weakness Enumeration

%idName
50% (1) CWE-269 Improper Privilege Management
50% (1) CWE-94 Failure to Control Generation of Code ('Code Injection')

Snort® IPS/IDS

Date Description
2014-11-16 Gitlab ssh key upload command injection attempt
RuleID : 31747 - Type : SERVER-WEBAPP - Revision : 4