Vulnerability · Published Apr 25, 2023 · Assigned by GitHub_M

CVE-2023-29012Git CMD erroneously executes `doskey.exe` in the current directory, if it exists

High 7.3

In plain English

A high-severity uncontrolled search path in git from git-for-windows. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 67.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory.

Affected products (as reported)

Vendor	Product	Versions
git-for-windows	git	< 2.40.1

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/git-for-windows/git/security/advisories/GHSA-gq5x-v87v-8f7g x_refsource_CONFIRM
https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1 x_refsource_MISC