Cyber Resilience

CVE-2022-24433

High

Published: 11 March 2022

Published
11 March 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0051 67.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-24433 is a high-severity Argument Injection (CWE-88) vulnerability in Simple-Git Project Simple-Git. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 33.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was…

more

possible to get arbitrary command execution.

CWE(s)
CWE-88

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

simple-git project
simple-git
≤ 3.3.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References