Lucene search

[email protected]CVE-2022-24767

HistoryApr 12, 2022 - 6:15 p.m.

CVE-2022-24767

2022-04-1218:15:00

CWE-427

[email protected]

web.nvd.nist.gov

127

cve-2022-24767

github

git for windows

uninstaller

dll hijacking

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

24.6%

JSON

GitHub: Git for Windows’ uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.

CPENameOperatorVersion
microsoft:visual_studio_2022microsoft visual studio 2022lt17.1.4
microsoft:visual_studio_2017microsoft visual studio 2017lt15.9.46
microsoft:visual_studio_2019microsoft visual studio 2019lt16.7.27
microsoft:visual_studio_2019microsoft visual studio 2019lt16.9.19
microsoft:visual_studio_2019microsoft visual studio 2019lt16.11.12
microsoft:visual_studio_2022microsoft visual studio 2022lt17.0.8
git_for_windows_project:git_for_windowsgit for windows project git for windowslt2.35.2

CPE	Name	Operator	Version
microsoft:visual_studio_2022	microsoft visual studio 2022	lt	17.1.4
microsoft:visual_studio_2017	microsoft visual studio 2017	lt	15.9.46
microsoft:visual_studio_2019	microsoft visual studio 2019	lt	16.7.27
microsoft:visual_studio_2019	microsoft visual studio 2019	lt	16.9.19
microsoft:visual_studio_2019	microsoft visual studio 2019	lt	16.11.12
microsoft:visual_studio_2022	microsoft visual studio 2022	lt	17.0.8
git_for_windows_project:git_for_windows	git for windows project git for windows	lt	2.35.2