Vulnerability Description
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | 5.0.0 |
| Gitlab | Gitlab-Shell | <= 1.7.2 |
References
- https://www.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/PatchVendor Advisory
- https://www.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/PatchVendor Advisory
FAQ
What is CVE-2013-4490?
CVE-2013-4490 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands v...
How severe is CVE-2013-4490?
CVE-2013-4490 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-4490?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab, Gitlab Gitlab-Shell.