[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110722203544.GA30239@blizzard>
Date: Fri, 22 Jul 2011 22:35:44 +0200
From: Lukas Fleischer <cgit@...ptocrack.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- cGit -- XSS flaw in rename hint
On Fri, Jul 22, 2011 at 06:48:38PM +0200, Jan Lieskovsky wrote:
> Hello Josh, Steve, vendors,
>
> an cross-site scripting (XSS) flaw was found in the way cgit, a fast
> web interface for Git, displayed the file name in the rename hint. A
> remote attacker could provide a specially-crafted web page, which once
> visited by an authenticated Cgit user, with push access to the
> repository, would lead to arbitrary web script or HTML code execution.
I think you are a tad off, here. The vulnerability I discovered actually
is only exploitable *by* a user with push access as it requires to push
a commit that renames any file to a file with a malicious file name.
The description (and the categorization of the vulnerability, which
definitely is a low severity one if it counts as a vulnerability at all)
should be corrected to reflect that.
>
> References:
> [1] http://hjemli.net/pipermail/cgit/2011-July/000276.html
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=725042
>
> Could you allocate a CVE id for this?
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
