High severity · published Apr 25, 2023
CVE-2023-29012
Git for Windows is the Windows port of Git
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GF
Git For Windows · Git For Windows Project
before 2.40.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29012
Release Notes
https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
Vendor Advisory
https://github.com/git-for-windows/git/security/advisories/GHSA-gq5x-v87v-8f7g
More from Git For Windows
7.8
CVE-2023-29011
Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g
7.8
CVE-2023-23618
Git for Windows is the Windows port of the revision control system Git
7.8
CVE-2022-24767
GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account
7.8
CVE-2016-9274
Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the current working directory
7.3
CVE-2023-22743
Git for Windows is the Windows port of the revision control system Git