CVE-2024-32002

CVSS 3.1 Score 9.0 of 10 (high)

Details

Published May 14, 2024
CWE ID 434
CWE ID 22

Summary

CVE-2024-32002 is a critical vulnerability in Git, a revision control system. It affects versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 of Git software and can be exploited in repositories with submodules. The bug allows attackers to trick Git into writing files into the `.git/` directory instead of the submodule's worktree, enabling the execution of malicious code during the clone operation without user inspection. The vulnerability has been patched in the mentioned versions of Git. Disabling symbolic link support in Git prevents this attack from working properly, and caution should always be exercised when cloning repositories from untrusted sources due to potential risks to organizations' integrity and confidentiality of data stored within Git repositories.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-32002 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options