CVE-2011-2711: XSS
An cross-site scripting (XSS) flaw was found in the way cgit, a fast web interface for Git, processed the file name in the rename hint. A remote attacker, valid CGit user with push access to the repository, could use this flaw to execute arbitrary web script or HTML code via a push commit message, renaming some file to a file with specially-crafted file name.
References: [1] http://hjemli.net/pipermail/cgit/2011-July/000276.html
Other sources
Cross-site scripting (XSS) vulnerability in the printfileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2711?
CVE-2011-2711 has a medium severity level, allowing a remote attacker to exploit an XSS vulnerability.
How can I fix CVE-2011-2711?
To fix CVE-2011-2711, you should update to a version of cgit that is greater than 0.9.0.2, as this vulnerability has been addressed in later releases.
Who is affected by CVE-2011-2711?
CVE-2011-2711 affects valid users of cgit who have push access to the repository and are using vulnerable versions of the software.
What type of vulnerability is CVE-2011-2711?
CVE-2011-2711 is classified as a cross-site scripting (XSS) vulnerability.
What can an attacker achieve with CVE-2011-2711?
An attacker leveraging CVE-2011-2711 can execute arbitrary web scripts or HTML code in the context of a user accessing the affected cgit instance.