CVE-2023-22743

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227456.4tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2 CVE-2023-227467.5CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of t CVE-2023-227479.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227489.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227499.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-22755.4The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du CVE-2023-227509.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227519.8There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-227529.8There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-227539.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code e CVE-2023-227549.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code e CVE-2023-227559.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code e