CVE-2018-14912: Path Traversal
cgitcloneobjects in CGit before 1.2.1 has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cgitto a version that resolves this vulnerability.Fixed in 1.2.3+git20221219.50.91f2590+git2.39.1-1Fixed in 1.2.3+git20240802.70.09d24d7+git2.46.0-1Fixed in 1.2.3+git20250818.80.3346409+git2.51.0-1 - Upgrade
Upgrade
cgitto a version that resolves this vulnerability.Fixed in 1.2.1 - Configuration
Disable HTTP clone by setting enable-http-clone=0 to prevent the directory traversal vulnerability when enable-http-clone=1 is not turned off.
cgit enable-http-clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14912?
CVE-2018-14912 is classified as a medium severity vulnerability due to its potential for exploiting directory traversal.
How do I fix CVE-2018-14912?
To fix CVE-2018-14912, ensure that `enable-http-clone=0` is set or upgrade to CGit version 1.2.1 or later.
What software is affected by CVE-2018-14912?
CGit versions prior to 1.2.1 are affected by CVE-2018-14912, particularly when running on Debian systems.
What exploit does CVE-2018-14912 enable?
CVE-2018-14912 enables a directory traversal exploit that can expose sensitive filesystem information.
What is directory traversal in the context of CVE-2018-14912?
In the context of CVE-2018-14912, directory traversal allows an attacker to access files outside the intended directory paths, potentially leading to unauthorized data exposure.