CVE-2022-31012: falha de alta gravidade em git-for-windows git
Git for Windows' installer can be tricked into executing an untrusted binary
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for Windows. A patch is included in version 2.37.1. Two workarounds are available. Create the `C:\mingw64` folder and remove read/write access from this folder, or disallow arbitrary authenticated users to create folders in `C:\`.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
git-for-windows · gitCVEs relacionadas — git-for-windows git
No mesmo produto, das mais perigosas para as menos.
CVE-2022-41953HIGHGit clone remote code execution vulnerability in git-for-windowsEPSS 8.0%CVE-2022-24765MEDIUMUncontrolled search for the Git directory in Git for WindowsEPSS 1.0%CVE-2023-25815LOWGit looks for localized messages in the wrong placeEPSS 0.8%CVE-2026-62960HIGHGit for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on WindowsEPSS 0.5%CVE-2023-23618HIGHgitk can inadvertently call executables in the worktreeEPSS 0.4%CVE-2023-29011HIGHGit for Windows's config file of `connect.exe` is susceptible to malicious placingEPSS 0.4%