CVE-2020-9708 - GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function

Back Back to CVE browser

HIGH

GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function

Published Aug 14, 2020

7.5

HIGH

CVSS 3.1

EPSS 2.94%

Description

The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of the repository.

Affected products

Vendor Adobe Product Helix Default
unknown
Affected
- ≥ unspecified, < 1.3.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Adobe	Helix	unknown	Affected ≥ unspecified, < 1.3.1

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-22

Path Traversal

CWE-24

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30488
Advisory
https://github.com/adobe/git-server/security/advisories/GHSA-cgj4-x2hh-2x93
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30488		Advisory
https://github.com/adobe/git-server/security/advisories/GHSA-cgj4-x2hh-2x93		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner adobe

Published Aug 14, 2020

Updated Sep 16, 2024

Reserved Mar 2, 2020

Link CVE-2020-9708

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-9708

Red Hat

No data

ENISA EUVD

Assigner adobe

Published Aug 14, 2020

Updated Sep 16, 2024

Link EUVD-2020-30488

GitHub

No data