CVE-2024-6257 HIGH

CVE-2024-6257: HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

Vendor Hashicorp

Product Shared library

Weakness CWE-77

Published June 25, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

8.4/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

Key dates

02Disclosure timeline

June 25, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-6257 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

CVE-2024-6257: HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

01Description

02Disclosure timeline

03References

04Related CVE