critical9.8
CVE-2022-31267
Unescaped control characters in Gitblit
Impact
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.gitblit:gitblit | < 1.9.3 | 1.9.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitblit | Gitblit | Version 1.9.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/gitblit/gitblit/issues/1410
- https://github.com/gitblit/gitblit/releases/tag/v1.9.3
- https://github.com/advisories/GHSA-fh55-vwjc-69c7
- https://nvd.nist.gov/vuln/detail/CVE-2022-31267
- https://github.com/gitblit/gitblit/commit/9b4afad6f4be212474809533ec2c280cce86501a