CVE-2024-32002

🗓️ 14 May 2024 18:40:46Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 609 Views🌐 WEB

Git prior to 2.45.1 allows writing files into `.git/` director

Reporter	Title	Published	Views	Family All 222
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	30 Jul 202414:58	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	1 Jun 202420:19	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	6 Mar 202509:40	–	githubexploit
GithubExploit	Exploit for CVE-2025-2783	26 May 202512:51	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	27 Sep 202403:10	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	18 May 202402:42	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	17 May 202419:35	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	22 May 202411:32	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	18 May 202411:23	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	27 Jul 202423:44	–	githubexploit

NVD

Vulners

Vulnrichment

Node

git gitRange<2.39.4

git gitRange2.40.0–2.40.2

git gitRange2.42.0–2.42.2

git gitRange2.43.0–2.43.4

git gitMatch2.41.0

git gitMatch2.44.0

git gitMatch2.45.0

[
  {
    "vendor": "git",
    "product": "git",
    "versions": [
      {
        "version": "= 2.45.0",
        "status": "affected"
      },
      {
        "version": "= 2.44.0",
        "status": "affected"
      },
      {
        "version": ">= 2.43.0, < 2.43.4",
        "status": "affected"
      },
      {
        "version": ">= 2.42.0, < 2.42.2",
        "status": "affected"
      },
      {
        "version": "= 2.41.0",
        "status": "affected"
      },
      {
        "version": ">= 2.40.0, < 2.40.2",
        "status": "affected"
      },
      {
        "version": "< 2.39.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
git-scm	www.git-scm.com/docs/git-config
openwall	www.openwall.com/lists/oss-security/2024/05/14/2
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/
lists	www.lists.debian.org/debian-lts-announce/2024/06/msg00018.html
github	www.github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d
github	www.github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv
git-scm	www.git-scm.com/docs/git-clone
lists	www.lists.debian.org/debian-lts-announce/2024/09/msg00009.html

Parameter	Position	Path	Description	CWE
submodule path exploitation	nested	[email protected]:amalmurali47/git_rce.git	Git submodule path manipulation PoC enabling RCE during clone	CWE-22, CWE-434, CWE-59
symlink to .git	nested	[email protected]:amalmurali47/git_rce.git	Git submodule path manipulation PoC enabling RCE during clone	CWE-22, CWE-434, CWE-59
post-checkout hook	nested	https://github.com/amalmurali47/hook	Malicious hook repository used in CVE-2024-32002 PoC	CWE-22, CWE-434, CWE-59
malicious hook	nested	https://github.com/amalmurali47/hook	Malicious hook repository used in CVE-2024-32002 PoC	CWE-22, CWE-434, CWE-59
submodule path	nested	https://github.com/JakobTheDev/cve-2024-32002-submodule-rce.git	Submodule PoC for CVE-2024-32002 exploiting symlinks during clone	CWE-22, CWE-434, CWE-59
symlink to .git	nested	https://github.com/JakobTheDev/cve-2024-32002-submodule-rce.git	Submodule PoC for CVE-2024-32002 exploiting symlinks during clone	CWE-22, CWE-434, CWE-59

17 Jun 2026 07:29Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19

EPSS0.25334

SSVC

git submodule exploit patched symbolic link cloning