Name: CVE-2018-16976: Concurrent Execution using Shared Resource with Improper Synchronization
Creator: Rapid7
Published: 2018-09-12T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-16976, CWE-362, CVSS 8.1, EPSS 0.01166

Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.

CVSS Details

CVSS 3.1 Base Score: 8.1
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon_linux	—	Upgrade gitolite3	Oct 19, 2018	Sep 12, 2018
Debian	—	Upgrade gitolite3	Jul 30, 2024	Sep 12, 2018
Suse	—	Upgrade gitolite	Oct 6, 2018	Sep 12, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence