by Kastro
Paper/Archive/CVE-2024-47516

CVE-2024-47516

redhat — Pagure: argument injection in pagurerepo.log()

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.3.603 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure instance.

Affected

ProductAffectedFixed inSource
pagure5.14.1–CNA

Scores by source

redhat (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refaccess.redhat.com/security/cve/CVE-2024-47516refbugzilla.redhat.com/show_bug.cgi?id=2315805