CVE-2024-50349
published 2025-01-14CVE-2024-50349: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to…
PriorityP424medium4.7CVSS 3.1
AVNACLPRNUIRSCCNILAN
EPSS
0.64%
47.1th percentile
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | git | < git 1:2.39.5-0+deb12u2 (bookworm) | git 1:2.39.5-0+deb12u2 (bookworm) |
| git | git | < 2.40.4 | 2.40.4 |
| git | git | <= 2.40.3 | — |
| git | git | — | — |
| git | git | — | — |
| git | git | — | — |
| git | git | — | — |
| git | git | — | — |
| git | git | — | — |
| git | git | — | — |
| git | git | — | — |
| git | git | — | — |
| git | git | >= 0 < 1:2.30.2-1+deb11u4 | 1:2.30.2-1+deb11u4 |
| git | git | >= 0 < 1:2.39.5-0+deb12u2 | 1:2.39.5-0+deb12u2 |
| git | git | >= 0 < 1:2.47.2-0.1 | 1:2.47.2-0.1 |
| git | git | >= 0 < 1:2.47.2-0.1 | 1:2.47.2-0.1 |
| git | git | >= 0 < 1:2.25.1-1ubuntu3.14 | 1:2.25.1-1ubuntu3.14 |
| git | git | >= 0 < 1:2.34.1-1ubuntu1.12 | 1:2.34.1-1ubuntu1.12 |
| git | git | >= 0 < 1:2.43.0-1ubuntu7.2 | 1:2.43.0-1ubuntu7.2 |
| git | git | >= 0 < 1:2.7.4-0ubuntu1.10+esm13 | 1:2.7.4-0ubuntu1.10+esm13 |
| git | git | >= 0 < 1:2.17.1-1ubuntu0.18+esm6 | 1:2.17.1-1ubuntu0.18+esm6 |
| git | git | >= 2.41.0 < 2.41.3 | 2.41.3 |
| git | git | >= 2.42.0 < 2.42.4 | 2.42.4 |
| git | git | >= 2.43.0 < 2.43.6 | 2.43.6 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.1LOW
vendor_ubuntu4.7MEDIUM
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Git vulnerabilities
vendor_ubuntu·2026-01-15·CVSS 4.7
CVE-2024-52006 [MEDIUM] Git vulnerabilities
Title: Git vulnerabilities
Summary: Several security issues were fixed in Git.
It was discovered that Git did not properly sanitize URLs when asking for
credentials via a terminal prompt. An attacker could possibly use this
issue to trick a user into disclosing their password. (CVE-2024-50349)
It was discovered that Git did not properly handle carriage return
characters in its credential protocol. An attacker could use this issue to
send unexpected data to credential helpers, possibly leading to a user
being tricked into disclosing sensitive information. (CVE-2024-52006)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Git vulnerabilities
vendor_ubuntu·2025-02-27·CVSS 4.7
CVE-2024-52006 [MEDIUM] Git vulnerabilities
Title: Git vulnerabilities
Summary: Several security issues were fixed in Git.
USN-7207-1 fixed vulnerabilities in Git. This update provides the
corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Git vulnerabilities
vendor_ubuntu·2025-01-14·CVSS 4.7
CVE-2024-52006 [MEDIUM] Git vulnerabilities
Title: Git vulnerabilities
Summary: Several security issues were fixed in Git.
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
git: Git does not sanitize URLs when asking for credentials interactively
vendor_redhat·2025-01-14·CVSS 2.1
CVE-2024-50349 [LOW] CWE-116 git: Git does not sanitize URLs when asking for credentials interactively
git: Git does not sanitize URLs when asking for credentials interactively
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This i
Debian
CVE-2024-50349: git - Git is a fast, scalable, distributed revision control system with an unusually r...
vendor_debian·2024·CVSS 2.1
CVE-2024-50349 [LOW] CVE-2024-50349: git - Git is a fast, scalable, distributed revision control system with an unusually r...
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included
OSV
git vulnerabilities
osv·2026-01-15·CVSS 2.1
CVE-2024-50349 [LOW] git vulnerabilities
git vulnerabilities
It was discovered that Git did not properly sanitize URLs when asking for
credentials via a terminal prompt. An attacker could possibly use this
issue to trick a user into disclosing their password. (CVE-2024-50349)
It was discovered that Git did not properly handle carriage return
characters in its credential protocol. An attacker could use this issue to
send unexpected data to credential helpers, possibly leading to a user
being tricked into disclosing sensitive information. (CVE-2024-52006)
OSV
git vulnerabilities
osv·2025-02-27·CVSS 2.1
CVE-2024-50349 [LOW] git vulnerabilities
git vulnerabilities
USN-7207-1 fixed vulnerabilities in Git. This update provides the
corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
OSV
git vulnerabilities
osv·2025-01-14·CVSS 2.1
CVE-2024-50349 [LOW] git vulnerabilities
git vulnerabilities
It was discovered that Git incorrectly handled certain URLs when
asking for credentials. An attacker could possibly use this
issue to mislead the user into typing passwords for trusted
sites that would then be sent to untrusted sites instead.
(CVE-2024-50349)
It was discovered that git incorrectly handled line endings when
using credential helpers. (CVE-2024-52006)
OSV
CVE-2024-50349: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full acce
osv·2025-01-14·CVSS 2.1
CVE-2024-50349 [LOW] CVE-2024-50349: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full acce
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-66413 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.3
CVE-2025-66413 [HIGH] CVE-2025-66413 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-66413 :
Git for Windows vulnerability analysis and mitigation
Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).
Source : NVD
## 7.4
Score
Published March 10, 2026
Severity HIGH
CNA Score 7.4
Affected Technologies
Git for Windows
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:git_for_windows_project:git_for_windows
Sources
NV
Bugzilla
CVE-2024-50349 git: Git does not sanitize URLs when asking for credentials interactively
bugzilla·2025-01-14·CVSS 2.1
CVE-2024-50349 [LOW] CVE-2024-50349 git: Git does not sanitize URLs when asking for credentials interactively
CVE-2024-50349 git: Git does not sanitize URLs when asking for credentials interactively
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's
2025-01-14
Published