What is CVE-2018-16976?

CVE-2018-16976 is a high-severity vulnerability in Gitolite, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 8.1/10. Published 2018-09-12.

How severe is CVE-2018-16976?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Gitolite

CVE-2018-16976

Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.

Vulnerability class: Race Condition

EPSS: 0.012 (64.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Gitolite
N/a — versions n/a

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Patch, Mailing List, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2018-16976?: CVE-2018-16976 is a high-severity vulnerability in Gitolite, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 8.1/10. Published 2018-09-12.
How severe is CVE-2018-16976?: High severity. CVSS v3 base score is 8.1 out of 10.