Lucene search

GitHub_MCVE-2023-23946

HistoryFeb 14, 2023 - 8:15 p.m.

CVE-2023-23946

2023-02-1420:15:17

CWE-22

GitHub_M

web.nvd.nist.gov

310

git

vulnerability

path traversal

security

nvd

cve-2023-23946

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

45.7%

JSON

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to git apply, a path outside the working tree can be overwritten as the user who is running git apply. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.

Affected configurations

Nvd

Vulners

Node

git-scmgitRange<2.30.8

git-scmgitRange2.31.0–2.31.7

git-scmgitRange2.32.0–2.32.6

git-scmgitRange2.33.0–2.33.7

git-scmgitRange2.34.0–2.34.7

git-scmgitRange2.35.0–2.35.7

git-scmgitRange2.36.0–2.36.5

git-scmgitRange2.37.0–2.37.6

git-scmgitRange2.38.0–2.38.4

git-scmgitRange2.39.0–2.39.2

VendorProductVersionCPE
git-scmgit*cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
git-scm	git	*	cpe:2.3:a:git-scm:git::::::::

CNA Affected

[
  {
    "vendor": "git",
    "product": "git",
    "versions": [
      {
        "version": ">= 2.39.0, < 2.39.2",
        "status": "affected"
      },
      {
        "version": ">= 2.38.0, < 2.38.4",
        "status": "affected"
      },
      {
        "version": ">= 2.37.0, < 2.37.6",
        "status": "affected"
      },
      {
        "version": ">= 2.36.0, < 2.36.5",
        "status": "affected"
      },
      {
        "version": ">= 2.35.0, < 2.35.7",
        "status": "affected"
      },
      {
        "version": ">= 2.34.0, < 2.34.7",
        "status": "affected"
      },
      {
        "version": ">= 2.33.0, < 2.33.7",
        "status": "affected"
      },
      {
        "version": ">= 2.32.0, < 2.32.6",
        "status": "affected"
      },
      {
        "version": ">= 2.31.0, < 2.31.7",
        "status": "affected"
      },
      {
        "version": "< 2.30.8",
        "status": "affected"
      }
    ]
  }
]