CVE-2024-3817
Assigner: HashiCorp
Published: 2024-04-17T19:37:25.878Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: 64 bit
32 bit
x86
ARM
MacOS
Windows
Linux
product: Shared library
repo: https://github.com/hashicorp/go-getter
vendor: HashiCorp
versions: lessThan: 1.7.3
status: affected
version: 1.5.9
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: <p>HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. 

This vulnerability does not affect the go-getter/v2 branch and package.</p><br/>
value: HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. 

This vulnerability does not affect the go-getter/v2 branch and package.
impacts: capecId: CAPEC-248
descriptions: value: CAPEC-248: Command Injection
metrics: cvssV3_1: baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-88
description: CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection)
type: CWE
source: advisory: HCSEC-2024-09
discovery: EXTERNAL
title: HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches