CVE-2024-32478

2024-04-1915:15:50

CWE-732

[email protected]

web.nvd.nist.gov

git credential manager

gcm

debian package

privilege escalation

fixed vulnerability

6.9 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

8.8%

JSON

Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users’ privileges. This vulnerability is fixed in 2.5.0.

Affected configurations

Vulners

Node

git-ecosystemgit_credential_managerRange<2.5.0

CNA Affected

[
  {
    "vendor": "git-ecosystem",
    "product": "git-credential-manager",
    "versions": [
      {
        "version": "< 2.5.0",
        "status": "affected"
      }
    ]
  }
]