FKIE_CVE-2011-2711

Vulnerability from fkie_nvd - Published: 2011-08-03 00:55 - Updated: 2026-06-16 23:31
Severity
Summary
Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint.
References
secalert@redhat.comhttp://hjemli.net/git/cgit/commit/?h=stable&id=bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5Patch
secalert@redhat.comhttp://hjemli.net/pipermail/cgit/2011-July/000276.htmlPatch
secalert@redhat.comhttp://secunia.com/advisories/45358Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/45541
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2011/07/22/2Patch
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2011/07/22/6
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2011/07/22/7Patch
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2011/07/24/3Patch
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2011/07/24/4Patch
secalert@redhat.comhttp://www.osvdb.org/74050Patch
secalert@redhat.comhttp://www.securityfocus.com/bid/48866
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=725042Patch
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/68754
secalert@redhat.comhttps://hermes.opensuse.org/messages/10998459
af854a3a-2127-422b-91ae-364da2661108http://hjemli.net/git/cgit/commit/?h=stable&id=bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5Patch
af854a3a-2127-422b-91ae-364da2661108http://hjemli.net/pipermail/cgit/2011-July/000276.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/45358Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/45541
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/22/2Patch
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/22/6
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/22/7Patch
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/24/3Patch
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/07/24/4Patch
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/74050Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/48866
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=725042Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/68754
af854a3a-2127-422b-91ae-364da2661108https://hermes.opensuse.org/messages/10998459
Impacted products
Vendor Product Version
lars_hjemli cgit *
lars_hjemli cgit 0.1
lars_hjemli cgit 0.2
lars_hjemli cgit 0.3
lars_hjemli cgit 0.4
lars_hjemli cgit 0.5
lars_hjemli cgit 0.6
lars_hjemli cgit 0.6.1
lars_hjemli cgit 0.6.2
lars_hjemli cgit 0.6.3
lars_hjemli cgit 0.7
lars_hjemli cgit 0.7.1
lars_hjemli cgit 0.7.2
lars_hjemli cgit 0.8
lars_hjemli cgit 0.8.1
lars_hjemli cgit 0.8.1.1
lars_hjemli cgit 0.8.2
lars_hjemli cgit 0.8.2.1
lars_hjemli cgit 0.8.2.2
lars_hjemli cgit 0.8.3
lars_hjemli cgit 0.8.3.1
lars_hjemli cgit 0.8.3.2
lars_hjemli cgit 0.8.3.3
lars_hjemli cgit 0.8.3.4
lars_hjemli cgit 0.8.3.5
lars_hjemli cgit 0.9
lars_hjemli cgit 0.9.0.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "59D7FA07-D0C9-4D09-80CA-6DAF7A977132",
              "versionEndIncluding": "0.9.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EED1FFDD-4C04-415A-A6D6-8DAB2998A8AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "23F704C1-4129-47D9-B844-B3E20696E36D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "434FAA85-D943-4E63-85C9-F0883CEB53E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DF1115A-A47F-4A4F-8AED-F24302A0DF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "374B218F-A4D0-4704-A2A8-74F8A7D5759A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED123524-4D31-469E-9B2A-504033ACFE46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE0D9623-3291-4DD1-9966-2307F7BB20B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED6865FF-0102-46FA-8A2A-23FAC59CF1FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8F178CE-4D7E-41CE-AA63-78E516063A7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FE3007F-6BDA-42FC-84E0-19E271E6577D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "69087A94-2220-4F10-ACF4-337541661A1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B0D564C-2F88-42E9-AF86-821DB37C8FD6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BD8D272-6729-4AEC-8058-6C6644165947",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "73FBD314-B417-4E83-827D-CC91861629B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9AE4ADD1-765B-4E83-A918-CE0DC1B30948",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "79FE9604-158B-4272-8DD2-A43CEC9885BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "545A1C08-F649-4226-852F-7AC7FFCA41ED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "783F5116-FD04-4D42-8EAA-C1CEF41A0C00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B6063B5-BA90-407C-9068-A853E27C76BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AD828C7-AC59-412C-A560-D5B944D357A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "59943A07-8B85-4EB5-B8E7-E4587D472D31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF02DFB4-BA4D-4A36-9F0A-E0D04727A206",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D953ABA-EE07-4796-9B3A-516C3B8E198D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.8.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1211001-96A0-4686-A718-E1F6FE0FB520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BFB6787-0F9E-45C1-B967-0E2A7CEC1F14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lars_hjemli:cgit:0.9.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C6EE19E-B467-430F-A53E-FD4A1D3ED753",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la funci\u00f3n print_fileinfo de ui-diff.c de cgit v0.9.0.2 y anteriores, permite a usuarios autenticados en remoto inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del nombre de fichero asociado con el campo de renombrar."
    }
  ],
  "id": "CVE-2011-2711",
  "lastModified": "2026-06-16T23:31:50.850",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-08-03T00:55:01.660",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://hjemli.net/git/cgit/commit/?h=stable\u0026id=bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://hjemli.net/pipermail/cgit/2011-July/000276.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45358"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/45541"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/6"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/7"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/24/3"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/24/4"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.osvdb.org/74050"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/48866"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=725042"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68754"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://hermes.opensuse.org/messages/10998459"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://hjemli.net/git/cgit/commit/?h=stable\u0026id=bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://hjemli.net/pipermail/cgit/2011-July/000276.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/45358"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/45541"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/22/7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/24/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2011/07/24/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.osvdb.org/74050"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/48866"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=725042"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68754"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://hermes.opensuse.org/messages/10998459"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.