CVE-2023-22743highCWE-426

CVE-2023-22743: falha de alta gravidade em git-for-windows git

Git for Windows' installer is susceptible to DLL side loading attacks

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar git

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 0.4%
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
git-for-windows · git
CVEs relacionadas — git-for-windows git

No mesmo produto, das mais perigosas para as menos.

CVE-2022-41953HIGHGit clone remote code execution vulnerability in git-for-windowsEPSS 8.0%CVE-2022-24765MEDIUMUncontrolled search for the Git directory in Git for WindowsEPSS 1.0%CVE-2023-25815LOWGit looks for localized messages in the wrong placeEPSS 0.8%CVE-2026-62960HIGHGit for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on WindowsEPSS 0.5%CVE-2022-31012HIGHGit for Windows' installer can be tricked into executing an untrusted binaryEPSS 0.4%CVE-2023-23618HIGHgitk can inadvertently call executables in the worktreeEPSS 0.4%