CVE-2024-32002

🗓️ 14 May 2024 18:40:46Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 653 Views🌐 WEB

Git prior to 2.45.1 allows writing files into `.git/` director

Reporter	Title	Published	Views	Family All 223
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	30 Jul 202414:58	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	1 Jun 202420:19	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	6 Mar 202509:40	–	githubexploit
GithubExploit	Exploit for CVE-2025-2783	26 May 202512:51	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	27 Sep 202403:10	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	18 May 202402:42	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	17 May 202419:35	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	22 May 202411:32	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	18 May 202411:23	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	27 Jul 202423:44	–	githubexploit

NVD

Vulners

Vulnrichment

Node

git gitRange<2.39.4

git gitRange2.40.0–2.40.2

git gitRange2.42.0–2.42.2

git gitRange2.43.0–2.43.4

git gitMatch2.41.0

git gitMatch2.44.0

git gitMatch2.45.0

[
  {
    "vendor": "git",
    "product": "git",
    "versions": [
      {
        "version": "= 2.45.0",
        "status": "affected"
      },
      {
        "version": "= 2.44.0",
        "status": "affected"
      },
      {
        "version": ">= 2.43.0, < 2.43.4",
        "status": "affected"
      },
      {
        "version": ">= 2.42.0, < 2.42.2",
        "status": "affected"
      },
      {
        "version": "= 2.41.0",
        "status": "affected"
      },
      {
        "version": ">= 2.40.0, < 2.40.2",
        "status": "affected"
      },
      {
        "version": "< 2.39.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
git-scm	www.git-scm.com/docs/git-config
openwall	www.openwall.com/lists/oss-security/2024/05/14/2
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/
lists	www.lists.debian.org/debian-lts-announce/2024/06/msg00018.html
github	www.github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d
github	www.github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv
git-scm	www.git-scm.com/docs/git-clone
lists	www.lists.debian.org/debian-lts-announce/2024/09/msg00009.html

Parameter	Position	Path	Description	CWE
core.symlinks	path	amalmurali47/git_rce	POC demonstrating Git CVE-2024-32002 submodule RCE via crafted submodule paths and symlinks	CWE-59, CWE-434, CWE-22
dotgit.txt	path	amalmurali47/git_rce	POC demonstrating Git CVE-2024-32002 submodule RCE via crafted submodule paths and symlinks	CWE-59, CWE-434, CWE-22
post-checkout	path	amalmurali47/git_rce	POC demonstrating Git CVE-2024-32002 submodule RCE via crafted submodule paths and symlinks	CWE-59, CWE-434, CWE-22
git submodule add --name x/y	path	amalmurali47/git_rce	POC demonstrating Git CVE-2024-32002 submodule RCE via crafted submodule paths and symlinks	CWE-59, CWE-434, CWE-22
post-checkout	path	amalmurali47/hook	Malicious git hook used in CVE-2024-32002 PoC	CWE-59, CWE-434, CWE-22
hook	path	amalmurali47/hook	Malicious git hook used in CVE-2024-32002 PoC	CWE-59, CWE-434, CWE-22
submodule path	path	JakobTheDev/cve-2024-32002-submodule-rce.git	Submodule-based RCE PoC leveraging symlinks to .git during clone	CWE-59, CWE-434, CWE-22
symlink to .git	path	JakobTheDev/cve-2024-32002-submodule-rce.git	Submodule-based RCE PoC leveraging symlinks to .git during clone	CWE-59, CWE-434, CWE-22
submodule path	path	JakobTheDev/cve-2024-32002-submodule-aw	AW PoC for arbitrary write into .git via submodule path manipulation	CWE-59, CWE-434, CWE-22
dotgit	path	JakobTheDev/cve-2024-32002-submodule-aw	AW PoC for arbitrary write into .git via submodule path manipulation	CWE-59, CWE-434, CWE-22

17 Jun 2026 07:29Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19

EPSS0.29234

SSVC

git submodule exploit patched symbolic link cloning