CVE-2024-32004— Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-32004
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
Source: NVD (National Vulnerability Database)
Vulnerability Description
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
流程控制
Source: NVD (National Vulnerability Database)
Vulnerability Title
Microsoft Visual Studio 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Visual Studio是美国微软（Microsoft）公司的一款开发工具套件系列产品，也是一个基本完整的开发工具集，它包括了整个软件生命周期中所需要的大部分工具。 Microsoft Visual Studio 存在安全漏洞。以下产品和版本受到影响：Microsoft Visual Studio 2022 version 17.8,Microsoft Visual Studio 2022 version 17.9,Microsoft Visual Studio 2022 versi
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-32004
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/Wadewfsssss/CVE-2024-32004 | POC Details |
| 2 | None | https://github.com/10cks/CVE-2024-32004-POC | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-32004
请登录查看更多情报信息。
- https://git-scm.com/docs/git-clonex_refsource_MISC
- https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2024-32004
Same Patch Batch · git · 2024-05-14 · 5 CVEs total
| CVE-2024-32002 | 9.1 CRITICAL | Git's recursive clones on case-insensitive filesystems that support symlinks are susceptib |
| CVE-2024-32465 | 7.4 HIGH | Git's protections for cloning untrusted repositories can be bypassed |
| CVE-2024-32020 | 3.9 LOW | Cloning local Git repository by untrusted user allows the untrusted user to modify objects |
| CVE-2024-32021 | 3.9 LOW | Local Git clone may hardlink arbitrary user-readable files into the new repository's "obje |
IV. Related Vulnerabilities
Same product: git
- CVE-2026-32631
Git for Windows: `git clone` from manipulated repositories c - CVE-2025-66413
Git for Windows leaks NTLM hash when cloning from an attacke - CVE-2025-48384
Git allows arbitrary code execution through broken config qu - CVE-2025-48385
Git alllows arbitrary file writes via bundle-uri parameter i - CVE-2025-48386
Git allows a buffer overflow in 'wincred' credential helper
Same vendor: git
- CVE-2025-48384
Git allows arbitrary code execution through broken config qu - CVE-2025-48385
Git alllows arbitrary file writes via bundle-uri parameter i - CVE-2025-48386
Git allows a buffer overflow in 'wincred' credential helper - CVE-2024-52005
The sideband payload is passed unfiltered to the terminal in - CVE-2024-50349
Git does not sanitize URLs when asking for credentials inter
V. Comments for CVE-2024-32004
No comments yet