PatchTheCVEkallithea vulnerabilities and fixes
Recent CVEs affecting kallithea, with upgrade or downgrade steps. 6 tracked.
kallithea has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2017-09-21. Highest priority: CVE-2015-5285 (score 46/100).
- CVE-2016-3691 HIGH 8.8 UPGRADE Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP r
- CVE-2016-3114 MEDIUM 6.5 DOWNGRADE Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete commen
- CVE-2015-5285 MEDIUM 5.0 UPGRADE CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers
- CVE-2015-1864 MEDIUM 5.4 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allo
- CVE-2015-0276 HIGH 8.8 UPGRADE Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
- CVE-2015-0260 MEDIUM 4.0 DOWNGRADE UPGRADE RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensit
FAQ
How do I fix kallithea vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is kallithea being exploited right now?
None of the tracked kallithea CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which kallithea CVE should I patch first?
CVE-2015-5285 currently ranks highest (46/100): CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers .