CVE-2013-4451

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/sitaramc/gitolite/commit/3dad4f8e3214d6ab5f71823019a624fa48b055a3Patch, Third Party Advisory
https://groups.google.com/forum/#%21topic/gitolite/Tu1sjaf7A4A/discussion
https://www.openwall.com/lists/oss-security/2013/10/21/11Mailing List, Patch
https://www.securityfocus.com/bid/63237Third Party Advisory, VDB Entry
https://github.com/sitaramc/gitolite/commit/3dad4f8e3214d6ab5f71823019a624fa48b055a3Patch, Third Party Advisory
https://groups.google.com/forum/#%21topic/gitolite/Tu1sjaf7A4A/discussion
https://www.openwall.com/lists/oss-security/2013/10/21/11Mailing List, Patch
https://www.securityfocus.com/bid/63237Third Party Advisory, VDB Entry

Timeline

Published: Sep 21, 2018
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-44522.1Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows lo CVE-2013-44534.3Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remote attackers to injec CVE-2013-44549.1WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities CVE-2013-44552.1Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, CVE-2013-44576.8The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, rela CVE-2013-44585.0Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlie CVE-2013-44593.3LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to byp CVE-2013-44603.5Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to i CVE-2013-44617.5SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary S CVE-2013-44629.1WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability CVE-2013-44632.1OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to CVE-2013-44654.6Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authen