Lucene search

GitHub_MCVELIST:CVE-2022-41943

HistoryNov 22, 2022 - 12:00 a.m.

CVE-2022-41943 Incorrect default permissions found in Sourcegraph

2022-11-2200:00:00

CWE-276

GitHub_M

www.cve.org

sourcegraph

permissions

cve-2022-41943

gitserver

security issue

v4.1.0

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental customGitFetch feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

CNA Affected

[
  {
    "vendor": "sourcegraph",
    "product": "sourcegraph",
    "versions": [
      {
        "version": "< 4.1.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/sourcegraph/sourcegraph/pull/42704

github.com/sourcegraph/sourcegraph/security/advisories/GHSA-4qhq-4x4h-fxm8

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

Related for CVELIST:CVE-2022-41943