CVE-2024-32478

CVSS V2 None CVSS V3 None

Description

Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.

Overview

CVE ID
CVE-2024-32478

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-04-19T14:37:57.617Z

Last Modified Date
2024-04-19T14:37:57.617Z

Weakness Enumerations

CWE	URL
CWE-732	http://cwe.mitre.org/data/definitions/732.html

References

Reference URL	Reference Tags
https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-3c3g-h9rx-f7vq	x_refsource_CONFIRM
https://github.com/git-ecosystem/git-credential-manager/commit/d9ac33c5b1478383672b4425f5ecf875a62efba9	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-32478
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32478

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 08:54:57				Added to TrackCVE