{
  "affected": [
    {
      "database_specific": {
        "unresolved_ranges": [
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "2.10.2"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "2.11.0"
              },
              {
                "fixed": "2.11.2"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "2.12.0"
              },
              {
                "fixed": "2.12.1"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "32"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "33"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "15.0-sp1"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "15.0-sp2"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "15.1"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "15.2"
              }
            ]
          }
        ]
      }
    }
  ],
  "details": "Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.",
  "id": "CVE-2020-24614",
  "modified": "2026-03-15T21:46:14.033039103Z",
  "published": "2020-08-25T14:15:16.793Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARYF4YMYXCANXUDS3B3CA4JGUZNUJOJA/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVZK4K7SFBQRCGCHS76HW2LTSEH2KSUM/"
    },
    {
      "type": "ADVISORY",
      "url": "http://www.openwall.com/lists/oss-security/2020/08/25/1"
    },
    {
      "type": "ADVISORY",
      "url": "https://fossil-scm.org/forum/info/a05ae3ce7760daf6"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.openwall.com/lists/oss-security/2020/08/20/1"
    },
    {
      "type": "ADVISORY",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00065.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://fossil-scm.org/fossil/vdiff?branch=sec2020-2.12-patch\u0026diff=1\u0026w"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/202011-04"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}