Paper/Archive/CVE-2022-24439

CVE-2022-24439

snyk — Remote Code Execution (RCE)

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 93.5.935 × 2018.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Affected

ProductAffectedFixed inSource

GitPython< unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

snyk (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References