Vulnerabilitycritical
Multiple Git flaws led to credentials compromise
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-52006 | Git: Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems… | 2.1 | 1% | ||
| CVE-2024-53263 | Git LFS: When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)`… | 8.5 | 1% | ||
| CVE-2024-53858 | The gh cli is GitHub’s official command line tool | 6.5 | <1% | ||
| CVE-2025-23040 | GitHub Desktop: An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's… | 6.6 | <1% |
From the original article
2 min read at securityaffairs.comVulnerabilities in the Git credential retrieval protocol could have allowed threat actors to access user credentials. Security researcher RyotaK from GMO Flatt Security Inc discovered multiple vulnerabilities in the Git credential retrieval protocol that could have allowed threat actors to access user credentials. The vulnerabilities stem from the improper handling of messages in Git’s credential retrieval protocol.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.