Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2024-35186
Good to know:
Date: May 23, 2024
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
Language: RUST
Severity Score
Related Resources (12)
Severity Score
Weakness Type (CWE)
Relative Path Traversal
CWE-23Top Fix
Upgrade Version
Upgrade to version gitoxide - 0.36.0, gitoxide-core - 0.38.0, gix - 0.63.0, gix-fs - 0.11.0, gix-index - 0.33.0, gix-worktree - 0.34.0, gix-worktree-state - 0.11.0
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |