Insecure DLL loading in Git - CVE-2022-24767

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU62260

Insecure DLL loading in Git - CVE-2022-24767

Published: April 12, 2022


Vulnerability identifier: #VU62260
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-24767
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the uninstaller binary loads DLL libraries in an insecure manner from the current working directory. A local user can place a specially crafted .dll file onto the system, trick the victim to run the uninstaller binary from that directory and execute arbitrary code with elevated privileges.


Affected software

Git
Visual Studio

How to mitigate CVE-2022-24767

Install updates from vendor's website.

Git - update to 2.35.2

External References

Related Security Bulletins