What is CVE-2021-23632?

CVE-2021-23632 is a medium-severity vulnerability in Git_project Git, classified under OS Command Injection. CVSS score: 6.6/10. Published 2022-03-17.

How severe is CVE-2021-23632?

Medium severity. CVSS v3 base score is 6.6 out of 10.

Is CVE-2021-23632 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Git_project Git

CVE-2021-23632

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exp…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.022 (80.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Git_project Git
N/a Git — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-23632?: CVE-2021-23632 is a medium-severity vulnerability in Git_project Git, classified under OS Command Injection. CVSS score: 6.6/10. Published 2022-03-17.
How severe is CVE-2021-23632?: Medium severity. CVSS v3 base score is 6.6 out of 10.
Is CVE-2021-23632 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.