Vulnerability in Git-for-windows Git
CVE-2022-24765
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create th…
EPSS: 0.002 (37.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N.
Affected products
- Git-for-windows Git — versions < 2.35.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2
- git-scm.com/book/en/v2/Appendix-A:-Git-in-Other-Environments-Git-in-Bash
- git-scm.com/docs/git
- [oss-security] 20220412 git v2.35.2 and friends for CVE-2022-24765 (mailing-list)
- FEDORA-2022-e99ae504f5 (vendor-advisory)
- FEDORA-2022-3759ebabd2 (vendor-advisory)
- FEDORA-2022-2fec5f30be (vendor-advisory)
- support.apple.com/kb/HT213261
- 20220516 APPLE-SA-2022-05-16-8 Xcode 13.4 (mailing-list)
- FEDORA-2022-dfd7e7fc0e (vendor-advisory)
Frequently asked questions
- What is CVE-2022-24765?
- CVE-2022-24765 is a medium-severity vulnerability in Git-for-windows Git, classified under Uncontrolled Search Path Element. CVSS score: 6.0/10. Published 2022-04-12.
- How severe is CVE-2022-24765?
- Medium severity. CVSS v3 base score is 6.0 out of 10.
- Is CVE-2022-24765 known to be exploited?
- 16 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.