Unscored severity · published May 13, 2014
CVE-2013-4546
The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL
–
CVSS
1.5%
EPSS
No
On KEV
Description
The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GitLab · GitLab
5.0.0; 5.0.1; 5.1.0; 5.2.0; 5.3.0; 5.4.0; +7 more · source: NVD
GI
Gitlab-shell · Gitlab
through 1.7.3; 1.0.4; 1.1.0; 1.2.0; 1.3.0; 1.4.0; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4546
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/11/11/2
gitlab.com
https://gitlab.com/gitlab-org/gitlab-shell/blob/master/CHANGELOG
Patch
https://www.gitlab.com/2013/11/08/security-vulnerability-in-gitlab-shell/
More from GitLab
10.0
CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
10.0
CVE-2021-22205
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
9.8
CVE-2023-7028
Weak Password Recovery Mechanism for Forgotten Password in GitLab
9.8
CVE-2021-22175
GitLab Server-Side Request Forgery (SSRF) Vulnerability
7.5
CVE-2021-39935
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability