CVE-2023-23946 is a path traversal vulnerability in Git, affecting versions prior to 2.39.2 and various earlier maintenance releases. A crafted input to git apply can overwrite files outside the working tree, executing as the user running the command. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high impact on integrity. While there is no evidence of active exploitation or publicly available exploit code, the vulnerability has garnered significant community discussion and media coverage, suggesting awareness among threat actors.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.30.8CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.31.0, < 2.31.7CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.32.0, < 2.32.6CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.33.0, < 2.33.7CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | ||
>= 2.34.0, < 2.34.7CPE matchmatch criteria | cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.