CVE-2025-66413
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
2Tags
Description
Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).
Analysis
Git for Windows is the Windows port of Git. versions up to 2.53.0 is affected by information exposure (CVSS 7.4).
Technical Context
This vulnerability (CWE-200: Information Exposure) affects Git for Windows is the Windows port of Git.. Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).
Affected Products
Product: Git for Windows is the Windows port of Git.. Versions: up to 2.53.0.
Remediation
Fixed in version 2.53.0. Restrict network access to the affected service where possible.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today