OpenCVE

All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Git	Git-shallow-clone

No data.

No data.

References

Link	Providers
https://github.com/10uei011/git-shallow-clone/blob/master/index.js%23L27
https://security.snyk.io/vuln/SNYK-JS-GITSHALLOWCLONE-3253853

History

Tue, 01 Oct 2024 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Git Git git-shallow-clone
CPEs		cpe:2.3:a:git:git-shallow-clone::::::::
Vendors & Products		Git Git git-shallow-clone
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 01 Oct 2024 05:15:00 +0000

Type	Values Removed	Values Added
Description		All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function.
Weaknesses		CWE-78
References		https://github.com/10uei011/git-shallow-clone/blob/master/index.js%23L27 https://security.snyk.io/vuln/SNYK-JS-GITSHALLOWCLONE-3253853
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P'}`

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2024-10-01T05:00:05.367Z

Updated: 2024-11-07T15:26:05.308Z

Reserved: 2023-12-22T12:33:20.122Z

Link: CVE-2024-21531

Vulnrichment

Updated: 2024-10-01T13:53:08.992Z

NVD

Status : Awaiting Analysis

Published: 2024-10-01T05:15:12.440

Modified: 2024-10-04T13:51:25.567

Link: CVE-2024-21531

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21531", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "state": "PUBLISHED", "assignerShortName": "snyk", "dateReserved": "2023-12-22T12:33:20.122Z", "datePublished": "2024-10-01T05:00:05.367Z", "dateUpdated": "2024-11-07T15:26:05.308Z"}, "containers": {"cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P"}}], "credits": [{"value": "Liran Tal - Snyk Research Team", "lang": "en"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "Command injection", "lang": "en"}]}], "providerMetadata": {"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2024-11-07T15:26:05.308Z"}, "descriptions": [{"value": "All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function.", "lang": "en"}], "references": [{"url": "https://security.snyk.io/vuln/SNYK-JS-GITSHALLOWCLONE-3253853"}, {"url": "https://github.com/10uei011/git-shallow-clone/blob/master/index.js%23L27"}], "affected": [{"product": "git-shallow-clone", "versions": [{"version": "0", "lessThan": "*", "status": "affected", "versionType": "semver"}], "vendor": "n/a"}]}, "adp": [{"affected": [{"vendor": "git", "product": "git-shallow-clone", "cpes": ["cpe:2.3:a:git:git-shallow-clone:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-01T13:47:26.389965Z", "id": "CVE-2024-21531", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T13:53:14.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-21531", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-01T13:47:26.389965Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:git:git-shallow-clone:*:*:*:*:*:*:*:*"], "vendor": "git", "product": "git-shallow-clone", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T13:53:08.992Z"}}], "cna": {"credits": [{"lang": "en", "value": "Liran Tal - Snyk Research Team"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "n/a", "product": "git-shallow-clone", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "semver"}]}], "references": [{"url": "https://security.snyk.io/vuln/SNYK-JS-GITSHALLOWCLONE-3253853"}, {"url": "https://github.com/10uei011/git-shallow-clone/blob/master/index.js%23L27"}], "descriptions": [{"lang": "en", "value": "All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "Command injection"}]}], "providerMetadata": {"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2024-11-07T15:26:05.308Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21531", "state": "PUBLISHED", "dateUpdated": "2024-11-07T15:26:05.308Z", "dateReserved": "2023-12-22T12:33:20.122Z", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "datePublished": "2024-10-01T05:00:05.367Z", "assignerShortName": "snyk"}, "dataVersion": "5.1"}