Vulnerability in Gforge

CVE-2009-3304

GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.

EPSS: 0.003 (23.8th percentile) — read the EPSS interpretation.

Affected products

Gforge — versions 4.5.14, 4.7, 4.8.2
N/a — versions n/a

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

References

cve@mitre.org (x_refsource_CONFIRM, Patch)
cve@mitre.org (Patch, vdb-entry, x_refsource_BID)
cve@mitre.org (vendor-advisory, Patch, x_refsource_DEBIAN)