CVE:CVE-2011-2711
CNNVD:CNNVD-201108-031
cgit 0.9.0.2及之前版本的ui-diff.c中的print_fileinfo函数中存在跨站脚本攻击漏洞。远程认证用户可借助与重命名提示有关的文件名注入任意web脚本或HTML。
solution:Upgrade lars_hjemli cgit to a higher version than 0.9.0.2,0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3,0.8.3.4,0.8.3.5,0.9,0.9.0.1,and avoid the version (,0.9.0.2],0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3,0.8.3.4,0.8.3.5,0.9,0.9.0.1