CVE:CVE-2013-2117
CNNVD:CNNVD-201305-581
cgit是用 C 编写的用于 git 存储库的超快 Web 前端。
cgit 0.9.2之前的版本中的ui-summary.c文件中的‘cgit_parse_readme’函数中存在路径遍历漏洞。当readme文件设置到文件系统路径中时，远程攻击者可通过URL参数中的‘..’利用该漏洞读取任意文件。
solution:Upgrade jason_a_donenfeld cgit to a higher version than 0.9.1,and avoid the version (,0.9.1]; Upgrade lars_hjemli cgit to a higher version than 0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3,0.8.3.4,0.8.3.5,0.9,0.9.0.1,0.9.0.2,0.9.0.3,and avoid the version 0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3,0.8.3.4,0.8.3.5,0.9,0.9.0.1,0.9.0.2,0.9.0.3