CVE-2023-22490: git before 2.30.8 (exclusive), from 2.31.0 (inclusive), before 2.31.7 (exclusive), from 2.32.0 (inclusive), before…

Affected technology

git · before 2.30.8 (exclusive)
git-scm

git · from 2.31.0 (inclusive), before 2.31.7 (exclusive)
git-scm

git · from 2.32.0 (inclusive), before 2.32.6 (exclusive)
git-scm

git · from 2.33.0 (inclusive), before 2.33.7 (exclusive)
git-scm

git · from 2.34.0 (inclusive), before 2.34.7 (exclusive)
git-scm

git · from 2.35.0 (inclusive), before 2.35.7 (exclusive)
git-scm

git · from 2.36.0 (inclusive), before 2.36.5 (exclusive)
git-scm

git · from 2.37.0 (inclusive), before 2.37.6 (exclusive)
git-scm

git · from 2.38.0 (inclusive), before 2.38.4 (exclusive)
git-scm

git · from 2.39.0 (inclusive), before 2.39.2 (exclusive)
git-scm

git · >= 2.39.0, < 2.39.2, >= 2.38.0, < 2.38.4, >= 2.37.0, < 2.37.6, >= 2.36.0, < 2.36.5, >= 2.35.0, < 2.35.7, >= 2.34.0, < 2.34.7, >= 2.33.0, < 2.33.7, >= 2.32.0, < 2.32.6, >= 2.31.0, < 2.31.7, < 2.30.8
git

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality impact as high; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.