CVE-2025-50977 (CNNVD-202508-3200)
中文标题:
Gitblit 安全漏洞
英文标题:
A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identifi...
漏洞描述
中文描述:
Gitblit是Gitblit的一个开源的纯 Java Git 解决方案，用于管理、查看和提供Git存储库。 Gitblit 1.7.1版本存在安全漏洞，该漏洞源于r参数处理不当，可能导致反射型跨站脚本攻击。
英文描述:
A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute JavaScript code in the context of the application. The flaw can be exploited through GET requests to the summary endpoint as well as POST requests to specific Wicket interface endpoints, though the GET method provides easier weaponization. This vulnerability enables authenticated administrators to execute arbitrary client-side code, potentially leading to session hijacking, data theft, or further privilege escalation attacks.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| gitblit | gitblit | 1.7.1 | - | - |
cpe:2.3:a:gitblit:gitblit:1.7.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (adp)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-50977 |
2025-11-11 15:23:26 | 2025-11-11 07:40:39 |
| NVD | nvd_CVE-2025-50977 |
2025-11-11 15:01:00 | 2025-11-11 07:48:26 |
| CNNVD | cnnvd_CNNVD-202508-3200 |
2025-11-11 15:12:55 | 2025-11-11 08:00:07 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-3200
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']