#VU102870 Improper Encoding or Escaping of Output in Git - CVE-2024-50349
Published: January 16, 2025
Vulnerability identifier: #VU102870
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-50349
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Git
Git
Software vendor:
Git
Git
Description
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect handling of control sequences in account names when asking for credentials. A remote attacker can trick the victim into clicking on a specially crafted URL and trick users into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
Remediation
Install updates from vendor's website.