CVE-2023-4759

27

FAUCET Score

CVE-2023-4759 is an arbitrary file overwrite vulnerability in Eclipse JGit versions up to 6.6.0, allowing a specially crafted Git repository to write files outside the working tree on case-insensitive filesystems like Windows and macOS. This can lead to remote code execution if, for example, a malicious Git filter is written. The vulnerability has a CVSS score of 8.8 (High) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no active exploitation or public exploit code is reported, and community discussion is minimal, the issue was fixed in JGit versions 6.6.1 and 6.7.0.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 5.13.3.202401111512-rCPE matchmatch criteria	cpe:2.3:a:eclipse:jgit::::::::
		>= 6.6.0, < 6.6.0.202305301015CPE matchmatch criteria	cpe:2.3:a:eclipse:jgit::::::::
		>= 6.7.0, < 6.7.0.202309050840CPE matchmatch criteria	cpe:2.3:a:eclipse:jgit::::::::

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

2.8

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.88%

Probability of exploitation in next 30 days

EPSS Percentile

77.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.0188 is in the 76th percentile among its peer group of 17,822 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

mavenpatch availablevia ghsa

Product: org.eclipse.jgit:org.eclipse.jgitFixed in: 6.6.1.202309021850-r

mavenpatch availablevia ghsa

Product: org.eclipse.jgit:org.eclipse.jgitFixed in: 5.13.3.202401111512-r

redhatpatch availablevia redhat_api

Product: EAP 8.0.1Fixed in: jgit

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application PlatformFixed in: org.eclipse.jgit/org.eclipse.jgit:5.13.2.SP1-redhat-00001

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-eclipse-jgit-0:5.13.2-1.SP1_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-eclipse-jgit-0:5.13.2-1.SP1_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-insights-java-client-0:1.1.1-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-elytron-0:1.15.21-1.Final_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-eclipse-jgit-0:5.13.2-1.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-insights-java-client-0:1.1.1-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-apache-sshd-0:2.12.0-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-eclipse-jgit-0:6.6.1.202309021850-1.r_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-log4j-0:2.19.0-2.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-lucene-solr-0:8.11.2-2.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-parsson-0:1.1.5-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-wildfly-0:8.0.1-3.GA_redhat_00002.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-apache-sshd-0:2.12.0-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-eclipse-jgit-0:6.6.1.202309021850-1.r_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-log4j-0:2.19.0-2.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-lucene-solr-0:8.11.2-2.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-parsson-0:1.1.5-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-wildfly-0:8.0.1-3.GA_redhat_00002.1.el9eap

redhatno patchvia redhat_api

Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: jgit

Vendor Advisories (2)

mavenGHSA-3p86-9955-h393high

Arbitrary File Overwrite in Eclipse JGit

redhatCVE-2023-4759Moderate

jgit: arbitrary file overwrite

References

git.eclipse.org / c/jgit/jgit.git/commit

PatchVendor Advisory

gitlab.eclipse.org / security/vulnerability-reports/-/issues/11

Issue TrackingVendor Advisory

projects.eclipse.org / projects/technology.jgit/releases/6.6.1

Release NotesVendor Advisory