{"id":32525,"date":"2025-09-02T18:50:00","date_gmt":"2025-09-02T18:50:00","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=32525"},"modified":"2026-04-17T18:07:35","modified_gmt":"2026-04-17T18:07:35","slug":"gitblit-authentication-bypass-vulnerability-cve-2024-28080","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/gitblit-authentication-bypass-vulnerability-cve-2024-28080\/","title":{"rendered":"Gitblit Authentication Bypass Vulnerability (CVE-2024-28080)"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, NSFOCUS CERT detected that Gitblit issued a security announcement and fixed the Gitblit authentication bypass vulnerability (CVE-2024-28080); Because Gitblit’s SSH service has defects in the public key authentication process, unauthenticated attackers can use the client’s public key to trigger signature verification failure and fall back to password-based authentication to complete SSH login with an empty password, thereby bypassing the system authentication process. The CVSS score is 9.2. At present, the vulnerability details and PoC have been made public. Relevant users are requested to take measures to protect themselves as soon as possible.<\/p>\n\n\n\n

Gitblit is an open source pure Java technology stack for managing, viewing and servicing Git repositories. It is mainly aimed at small and medium-sized workgroups that need to host centralized repositories. It supports multiple transport protocols and can be integrated with external tools.<\/p>\n\n\n\n

Reference link: https:\/\/www.gitblit.com\/releasenotes.html<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected versions<\/strong><\/strong><\/p>\n\n\n\n