CVE-2020-24614

high-risk

Published 2020-08-25

Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.

Do I need to act?

6.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (7)

Fossil

Fedora

Backports Sle

Leap

Affected Vendors

Fedoraproject Opensuse Fossil-Scm

References (16)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00065.html

Mailing List http://www.openwall.com/lists/oss-security/2020/08/25/1

Vendor Advisory https://fossil-scm.org/forum/info/a05ae3ce7760daf6

Third Party Advisory https://fossil-scm.org/fossil/vdiff?branch=sec2020-2.12-patch&diff=1&w

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202011-04

Mailing List https://www.openwall.com/lists/oss-security/2020/08/20/1

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00065.html

Mailing List http://www.openwall.com/lists/oss-security/2020/08/25/1

Vendor Advisory https://fossil-scm.org/forum/info/a05ae3ce7760daf6

Third Party Advisory https://fossil-scm.org/fossil/vdiff?branch=sec2020-2.12-patch&diff=1&w

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202011-04

Mailing List https://www.openwall.com/lists/oss-security/2020/08/20/1

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 9/34 · Low

Exposure 14/34 · Moderate