Medium severity · published Apr 19, 2024
CVE-2024-32478
Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files
6.9
CVSS
0.2%
EPSS
No
On KEV
Description
Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
git-credential-manager · git-ecosystem
< 2.5.0 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32478
github.com
https://github.com/git-ecosystem/git-credential-manager/commit/d9ac33c5b1478383672b4425f5ecf875a62efba9
github.com
https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-3c3g-h9rx-f7vq
More from git-credential-manager
7.4
CVE-2024-50338
Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager