#VU75486 Input validation error in Git for Windows - CVE-2023-29007
Published: April 25, 2023 / Updated: August 16, 2024
Vulnerability identifier: #VU75486
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2023-29007
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Git for Windows
Git for Windows
Software vendor:
Git for Windows
Git for Windows
Description
The vulnerability allows an attacker to tamper with Git configuration.
The vulnerability exists due to insufficient input validation in "git submodule deinit" when renaming or deleting a section from a configuration file. A remote attacker can trick the victim into running the command a malicious configuration file and tamper with Git configuration on the affected system.
Remediation
Install updates from vendor's website.