Command Injection
CVE-2022-24066

8.1HIGH

Key Information:

Vendor
Simple-git Project
Status
Simple-git
Vendor
CVE Published:
1 April 2022

Summary

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

Affected Version(s)

simple-git < 3.5.0

References

https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820
x_refsource_MISC
https://gist.github.com/lirantal/a930d902294b833514e82110...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Liran Tal
.