CVE-2018-10857

MEDIUM

git-annex - Exposure of Sensitive Information via Localhost or LAN Web Server

Title source: llm

Description

git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.

References (2)

Core 2

Core References

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html

Issue Tracking, Third Party Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10857

Scores

CVSS v3 5.9

EPSS 0.0154

EPSS Percentile 71.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

debian/debian_linux 8.0

git-annex_project/git-annex

Published Jul 16, 2018

Tracked Since Feb 18, 2026