#VU72245 Link following in Git - CVE-2023-23946
Published: February 15, 2023
Vulnerability identifier: #VU72245
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-23946
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Git
Git
Software vendor:
Git
Git
Description
The vulnerability allows an attacker to compromise the affected system.
The vulnerability exists due to application allows to overwrite files outside the working tree via the "git apply" command. A remote attacker can trick the victim to run the affected command against a malicious or compromised repository and overwrite arbitrary files on the system.
Remediation
Install updates from vendor's website.