Home > Vulnerability Database > CVE-2020-27955

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2020-27955

Good to know:

Date: November 5, 2020

Git LFS 2.12.0 allows Remote Code Execution.

Language: Go

Severity Score

9.8

Related Resources (11)

Url: https://exploitbox.io

Url: https://legalhackers.com

Url: http://seclists.org/fulldisclosure/2020/Nov/1

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-27955

Url: http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html

Url: https://github.com/git-lfs/git-lfs/releases

Url: https://github.com/git-lfs/git-lfs

Url: https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html

Url: https://github.com/git-lfs/git-lfs/security/advisories/GHSA-4g4p-42wc-9f3m

Url: http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html

Url: https://www.mend.io/vulnerability-database/CVE-2020-27955

Severity Score

9.8

Weakness Type (CWE)

Command Injection

CWE-77

Uncontrolled Search Path Element

CWE-427

Top Fix

Upgrade Version

Upgrade to version v2.12.1

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	10.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	COMPLETE
Integrity (I):	COMPLETE
Availability (A):	COMPLETE
Additional information:

Do you need more information?

Contact Us