Redmine Git Hosting Plugin CVE-2013-4663

Q: What is the CVSS score of CVE-2013-4663?

CVE-2013-4663 has a CVSS 2.0 base score of 7.5 (High). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 1.0%.

Q: Is there a public PoC exploit available for CVE-2013-4663?

Yes, a public proof-of-concept exploit is available for CVE-2013-4663. Prioritise patching immediately. EPSS: 1.0%.

HIGH

Command Injection (CWE-77)

2014-12-28 cve@mitre.org

Command Injection Redmine Git Hosting Plugin

7.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Dec 28, 2014 - 00:59 cve.org

HIGH 7.5

DescriptionCVE.org

git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function.

AnalysisAI

git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function. Affected products include: Redmine Redmine Git Hosting Plugin.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.