Lucene search

GitHub_MCVE-2021-21237

HistoryJan 15, 2021 - 6:15 p.m.

CVE-2021-21237

2021-01-1518:15:15

CWE-426

GitHub_M

web.nvd.nist.gov

git lfs

windows

cve-2021-21237

code execution

security patch

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.954

Percentile

99.4%

JSON

Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2.

Affected configurations

Nvd

Vulners

Node

git_large_file_storage_projectgit_large_file_storageRange<2.13.2

VendorProductVersionCPE
git_large_file_storage_projectgit_large_file_storage*cpe:2.3:a:git_large_file_storage_project:git_large_file_storage:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
git_large_file_storage_project	git_large_file_storage	*	cpe:2.3:a:git_large_file_storage_project:git_large_file_storage::::::::

CNA Affected

[
  {
    "product": "git-lfs",
    "vendor": "git-lfs",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.13.2"
      }
    ]
  }
]