CVE-2020-28086
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Git是一套免费、开源的分布式版本控制系统。 Git 1.7.3版本存在授权问题漏洞，该漏洞源于可以为意外资源使用密码。为了进行利用，用户必须执行一次git pull操作，解密密码，并使用密码登录到远程服务。如果攻击者可利用该漏洞控制中央Git服务器或其他成员的一个机器,并控制服务已经在密码存储之一,他们可以重命名一个Git仓库密码文件的其他东西:通过不正确的验证文件的内容匹配的文件名,那么用户可能会骗解密和发送错误的密码
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-28086
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
pass through 1.7.3 has a possibility of using a password for an unintended resource. For exploitation to occur, the user must do a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines, and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else: pass doesn't correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. NOTE: for environments in which this threat model is of concern, signing commits can be a solution.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Git 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Git是一套免费、开源的分布式版本控制系统。 Git 1.7.3版本存在授权问题漏洞，该漏洞源于可以为意外资源使用密码。为了进行利用，用户必须执行一次git pull操作，解密密码，并使用密码登录到远程服务。如果攻击者可利用该漏洞控制中央Git服务器或其他成员的一个机器,并控制服务已经在密码存储之一,他们可以重命名一个Git仓库密码文件的其他东西:通过不正确的验证文件的内容匹配的文件名,那么用户可能会骗解密和发送错误的密码
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2020-28086
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-28086
请登录查看更多情报信息。
Mailing List Discussions for CVE-2020-28086 (1)
Same Patch Batch · n/a · 2020-12-09 · 27 CVEs total
| CVE-2020-7787 | 8.2 HIGH | Improper Authentication |
| CVE-2020-7776 | 7.1 HIGH | Cross-site Scripting (XSS) |
| CVE-2020-29259 | SourceCodester Online Examination System 跨站脚本漏洞 | |
| CVE-2020-16587 | Industrial Light And Magic OpenEXR 缓冲区错误漏洞 | |
| CVE-2020-29258 | SourceCodester Online Examination System 跨站脚本漏洞 | |
| CVE-2020-29257 | SourceCodester Online Examination System 跨站脚本漏洞 | |
| CVE-2020-16600 | Artifex Software MuPDF 资源管理错误漏洞 | |
| CVE-2020-16599 | GNU Binutils 代码问题漏洞 | |
| CVE-2020-16593 | GNU Binutils 代码问题漏洞 | |
| CVE-2020-16592 | GNU Binutils 资源管理错误漏洞 | |
| CVE-2020-16591 | GNU Binutils 缓冲区错误漏洞 | |
| CVE-2020-16590 | GNU Binutils 资源管理错误漏洞 | |
| CVE-2020-25499 | TotoLink A3002RU 命令注入漏洞 | |
| CVE-2020-29660 | Linux kernel 资源管理错误漏洞 | |
| CVE-2020-29661 | Linux kernel 资源管理错误漏洞 | |
| CVE-2020-29659 | Flexense DupScout Enterprise 缓冲区错误漏洞 | |
| CVE-2020-25199 | Wecon Technologies LeviStudioU 缓冲区错误漏洞 | |
| CVE-2020-23520 | Imcat 代码问题漏洞 | |
| CVE-2020-29657 | JerryScript 缓冲区错误漏洞 | |
| CVE-2020-29655 | ASUS RT-AC88U 注入漏洞 |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2020-28086
No comments yet