CVE-2022-25912
CVE-2022-25912 · Remote Code Execution (RCE)
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
CVSS 8.1 · Alta · EPSS 3,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
simple-git
- Versiones
- ≥ unspecified, < 3.15.0: Afectada (custom)
Actualiza a 3.15.0
simple-git npm
- Intervalos de versiones afectados
- SEMVER: < 3.15.0
Actualiza a 3.15.0
Fuentes originales
- https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532
- https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0
- https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
- https://nvd.nist.gov/vuln/detail/CVE-2022-25912