CVE-2011-2711

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-08-03 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint.

Affected products

Lars Hjemli Cgit: through 0.9.0.2; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+20)

References

http://hjemli.net/git/cgit/commit/?h=stable&id=bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5
http://hjemli.net/pipermail/cgit/2011-July/000276.html
http://secunia.com/advisories/45358
http://secunia.com/advisories/45541
http://www.openwall.com/lists/oss-security/2011/07/22/2
http://www.openwall.com/lists/oss-security/2011/07/22/6
http://www.openwall.com/lists/oss-security/2011/07/22/7
http://www.openwall.com/lists/oss-security/2011/07/24/3
http://www.openwall.com/lists/oss-security/2011/07/24/4
http://www.osvdb.org/74050
http://www.securityfocus.com/bid/48866
https://bugzilla.redhat.com/show_bug.cgi?id=725042

Get alerted when CVE-2011-2711 or the next vulnerability affects your stack