CVE-2013-4490
medium · 6.5The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
6.5
CVSS
42.1%
EPSS (exploit prob.)
99th
EPSS percentile
2014-05-13
Published
AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab | 5.0.0 |
| gitlab | gitlab | 5.0.1 |
| gitlab | gitlab | 5.1.0 |
| gitlab | gitlab | 5.2.0 |
| gitlab | gitlab | 5.3.0 |
| gitlab | gitlab | 5.4.0 |
| gitlab | gitlab | 6.0.0 |
| gitlab | gitlab | 6.1.0 |
| gitlab | gitlab | 6.2.0 |
| gitlab | gitlab | 6.2.1 |
| gitlab | gitlab | 6.2.2 |
| gitlab | gitlab-shell | <= 1.7.2 |
| gitlab | gitlab-shell | 1.0.4 |
| gitlab | gitlab-shell | 1.1.0 |
| gitlab | gitlab-shell | 1.2.0 |
| gitlab | gitlab-shell | 1.3.0 |
| gitlab | gitlab-shell | 1.4.0 |
| gitlab | gitlab-shell | 1.5.0 |
| gitlab | gitlab-shell | 1.6.0 |
| gitlab | gitlab-shell | 1.7.0 |
| gitlab | gitlab-shell | 1.7.1 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2013-4490