Vulnerabilitymedium
GitHub Desktop Vulnerability Risks Credential Leaks via Malicious Remote URLs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-5260 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker | 7.5 | 10% | ||
| CVE-2024-50338 | Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux | 7.4 | 3% | ||
| CVE-2024-50349 | Git: When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for… | 2.1 | <1% | ||
| CVE-2024-52006 | Git: Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems… | 2.1 | 1% | ||
| CVE-2024-53263 | Git LFS: When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)`… | 8.5 | 1% | ||
| CVE-2024-53858 | The gh cli is GitHub’s official command line tool | 6.5 | <1% | ||
| CVE-2025-23040 | GitHub Desktop: An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's… | 6.6 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ghe.com | configured to be sent to hosts other than github[.]com and ghe[.]com as long as the environment variables GITHUB_ENTERPRISE_TO |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Jan 27, 2025 Vulnerability / Software Security Multiple security vulnerabilities have been disclosed in GitHub Desktop as well as other Git-related projects that, if successfully exploited, could permit an attacker to gain unauthorized access to a user's Git credentials.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.