CVE-2023-29011

CVE-2023-29011 is a high-severity vulnerability affecting Git for Windows, stemming from its connect.exe utility. This utility hardcodes its configuration file path to C:\etc\connectrc, allowing any authenticated user on a multi-user machine to create a malicious configuration file in C:\etc. This can lead to arbitrary code execution or other malicious activity when connect.exe is invoked. The vulnerability has a CVSS score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a local attack vector with low complexity, requiring user interaction, and resulting in high confidentiality, integrity, and availability impacts. It is classified as CWE-427 (Uncontrolled Search Path Element). As of the provided data, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, with only one mention and one article respectively, suggesting limited public awareness.