CVE-2023-23618

Katalog CVE

CVSS 7.8 · High EPSS 0,39%

Kerentanan Untrusted Search Path pada git for windows project git for windows. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

Rincian

Terbit di NVD

14 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm advisory vendor
• https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c patch
• https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1 release notes
• https://wiki.tcl-lang.org/page/exec not applicable