PT-2026-53215 · Gitbucket · Gitbucket
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
GitBucket versions prior to 4.46.2
Description
A server-side request forgery (SSRF) exists that allows remote attackers to manipulate the
url argument within the Git.cloneRepository.setURI() function located in the src/main/scala/gitbucket/core/service/RepositoryCreationService.scala file. SSRF is a flaw where an attacker can force the server to make requests to an unintended location.Recommendations
Deploy patch 487a9b980f56aa73b6a044b1e86a92eed5043215 for versions prior to 4.46.2.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitbucket