Back to Database
Status published
High
CVE-2018-16976
Gitolite before 3.6.9 does not (in certain configurations involving @all...
Vulnerability Description
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-16976
Credits & Attribution
No credits recorded in the NVD database.
References
More from gitolite
View All →CVE-2018-20683
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles...
High
8.1
CVE-2013-7203
gitolite before commit fa06a34 might allow local users to read...
Medium
5.5
CVE-2013-4451
gitolite commit fa06a34 through 3.5.3 might allow attackers to have...
Critical
9.8
CVE-2012-4506
Directory traversal vulnerability in gitolite 3.x before 3.1, when wild...
Medium
4.6
CVE-2011-1572
Directory traversal vulnerability in the Admin Defined Commands (ADC) feature...
Medium
6.8
Affected Vendor
gitolite
View all reports →Affected Software
gitolite
Vulnerable Versions:
0
Timeline
Official Publish:
September 12th, 2018
Last Modified:
September 16th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.