What is the CVSS score of CVE-2024-32478?

CVE-2024-32478 has a CVSS 3.1 base score of 6.9 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Debian CVE-2024-32478

MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2024-04-19 security-advisories@github.com

Debian Information Disclosure

6.9

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.9 MEDIUM

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Apr 19, 2024 - 15:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.

AnalysisAI

Git Credential Manager (GCM) is a secure Git credential helper. Rated medium severity (CVSS 6.9). No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0. Version information: Prior to 2.5.0.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.