CVE-2019-1387

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
Microsoft CorporationGitBefore v2.24.1; Before v2.23.1; Before v2.22.2; Before v2.21.1; Before v2.20.2; Before v2.19.3; Before v2.18.2; Before v2.17.3; Before v2.16.6; Before v2.15.4; Before v2.14.6
gitgit< 2,24.1; < 2.23.1; < 2.22.2; < 2.21.1; < 2.20.2; < 2.19.3; < 2.18.2; < 2.17.3; < 2.16.6; < 2.15.4; < 2.14.6

References

Timeline

Published
Dec 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-13887.8An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'WinCVE-2019-13898.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2019-13907.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutCVE-2019-13915.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. TCVE-2019-139157.5b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compiCVE-2019-139168.8An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet isCVE-2019-139179.8Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansionCVE-2019-139189.8A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent pasCVE-2019-139194.3A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by CVE-2019-13927.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaCVE-2019-139204.3A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not proCVE-2019-139217.5A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a
CVE-2019-1387: High severity, CVSS 8.8 | Vulnix