Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2000-0670: cvsweb lets repository writers execute system commands
CVE-2000-0670 · published 26 years ago
Summary
The cvsweb CGI script in CVSWeb 1.80 can run any command the server can execute if an attacker with write permission to a CVS repository adds special characters to its input. This means a trusted contributor could take control of the server or damage data. Limit write access to the repository, upgrade to a patched version, or apply input‑validation fixes to stop the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cvsweb_developer | cvsweb |
1.80 cpe:2.3:a:cvsweb_developer:cvsweb:1.80:*:*:*:*:*:*:* |
Original advisory text
The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharacters.
The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharacters.
References
- http://archives.neohapsis.com/archives/bugtraq/2000-07/0178.html
- http://archives.neohapsis.com/archives/bugtraq/2000-07/0196.html Exploit Patch Vendor Advisory
- http://www.securityfocus.com/bid/1469
- http://www.turbolinux.com/pipermail/tl-security-announce/2000-August/000015.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/4925
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
7.2
High
Timeline
Published12 Jul 2000
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2000-0670 · NVD
Track software like this
Free during beta