Home > Vulnerability Database > CVE-2024-35186

Mend.io Vulnerability Database

CVE-2024-35186

Date: May 23, 2024

gitoxide is a pure Rust implementation of Git. During checkout, "gix-worktree-state" does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

Language: RUST

Severity Score

8.8

Related Resources (8)

Url: https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c

Url: https://github.com/Byron/gitoxide

Url: https://github.com/advisories/GHSA-7w47-3wg8-547c

Url: https://rustsec.org/advisories/RUSTSEC-2024-0348.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-35186

Url: https://crates.io/crates/gix-fs

Url: https://rustsec.org/advisories/RUSTSEC-2024-0350.html

Url: https://www.mend.io/vulnerability-database/CVE-2024-35186

Severity Score

8.8

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

Relative Path Traversal

CWE-23

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2024-35186

Date: May 23, 2024

Language: RUST

Severity Score

Related Resources (8)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?