9.8

CVE-2014-9390: apple xcode Improper Input Validation

CVSS: 9.8v3.1CriticalModified
AliasesMGASA-2014-0546MGASA-2015-0325GHSA-6vvc-c2m3-cjf3
Published 12-02-2020Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-9390 is a critical (CVSS 9.8) Improper Input Validation vulnerability in apple xcode. EPSS estimates a 75.60% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
75.60%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
DLA-237-1OPENSUSE-SU-2024:10099-1

Timeline

  1. 12-02-2020
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

CVSS metrics

8 scores · 5 sources · 3 versions

EPSS trend

Probability

75.60%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 75.60% on 18-09-2026

18-09-202618-10-2026
EPSS score
75.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    Malicious Git and Mercurial HTTP Server For CVE-2014-9390

    exploit/multi/http/git_client_command_exec

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Debian5 products
  • dulwich< 0.10.1-1
  • git< 1:2.1.4-1
  • jgit< 3.7.0-1
  • libgit2< 0.21.3-1
  • mercurial< 3.1.2-2
Mageia3 products
  • cgit< 0.11.2-1.mga4
  • git< 1.8.5.6-1.mga4
  • cgit< 0.11.2-1.mga5
Ubuntu3 products
  • git< 1:1.9.1-1ubuntu0.1
  • libgit2All versions (No fix recorded)
  • mercurial< 2.8.2-1ubuntu1.3
Eclipse2 products
  • egit< 08-12-2014
  • jgit< 3.4.2 | ≥ 3.5.0, < 3.5.3
Apple1 product
  • xcode≤ 6.1.1 | 6.2 | 6.2:beta_2
Git-scm1 product
  • git< 1.8.5.6 | ≥ 1.9.0, < 1.9.5 | ≥ 2.0.0, < 2.0.5 | ≥ 2.1.0, < 2.1.4 | ≥ 2.2.0, < 2.2.1
Libgit21 product
Mercurial1 product
Org.eclipse.jgit1 product
  • org.eclipse.jgit< 3.5.3
PyPI1 product
  • mercurial< 3.2.3

10 vendors · 19 products

References

28 links
Show all 28 references