CVE-2024-32478CWE-732

Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files

Medium · published April 19, 2024

CVSS v3.1
6.9
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2024-04-19T14:37Z
EPSS history
Timeline
  • 19 APR 14:37Z
    Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files
    cvelistv5