Vulnerability	Vulnerable Version
M CRLF Injection Affected versions of this package are vulnerable to CRLF Injection by allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the `came_from` parameter to `_admin/login`. How to fix CRLF Injection? Upgrade `Kallithea` to version 0.3 or higher.	[,0.3)
M Information Exposure Affected versions of this package are vulnerable to Information Exposure due to allowing remote authenticated users to obtain API keys and other sensitive information via the `get_repo` API method. How to fix Information Exposure? A fix was pushed into the `master` branch but not yet published.	[0,)
H Cross-site Request Forgery (CSRF) `kallithea` is a fast and powerful management tool for Mercurial and Git with a built-in push/pull server, full text search and code-review. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) attacks. It allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.	[,0.3.2)
M Privilege Escalation `kallithea` is a fast and powerful management tool for Mercurial and Git with a built-in push/pull server, full text search and code-review. Affected versions of this package are vulnerable to Privilege Escalation. It allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access.	[,0.3.2)

Go back to all versions of this package