CVE-2023-22743highCWE-426

CVE-2023-22743: fallo de gravedad alta en git-for-windows git

Git for Windows' installer is susceptible to DLL side loading attacks

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear git

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.3epss 0.4%
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Productos afectados
git-for-windows · git
CVEs relacionadas — git-for-windows git

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-41953HIGHGit clone remote code execution vulnerability in git-for-windowsEPSS 8.0%CVE-2022-24765MEDIUMUncontrolled search for the Git directory in Git for WindowsEPSS 1.0%CVE-2023-25815LOWGit looks for localized messages in the wrong placeEPSS 0.8%CVE-2026-62960HIGHGit for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on WindowsEPSS 0.5%CVE-2022-31012HIGHGit for Windows' installer can be tricked into executing an untrusted binaryEPSS 0.4%CVE-2023-23618HIGHgitk can inadvertently call executables in the worktreeEPSS 0.4%