Input validation error in steveukx simple-git



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-25860
CWE-ID CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Simple Git
Web applications / Modules and components for CMS

Vendor Steve King

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Input validation error

EUVDB-ID: #VU97701

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-25860

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute remote code on the system.

The vulnerability exists due to improper input sanitization. A remote attacker can pass specially crafted input to the application and execute remote code on the system using the clone(), pull(), push() and listRemote() methods.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Simple Git: All versions

CPE2.3 External links

https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3177391
https://github.com/steveukx/git-js/pull/881/commits/95459310e5b8f96e20bb77ef1a6559036b779e13
https://github.com/steveukx/git-js/commit/ec97a39ab60b89e870c5170121cd9c1603cc1951


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###