Lucene search

GoogleOSV:CVE-2022-41943

HistoryNov 22, 2022 - 7:15 p.m.

CVE-2022-41943

2022-11-2219:15:18

Google

osv.dev

sourcegraph

code intelligence

arbitrary command execution

gitserver

customgitfetch

experimental feature

version 4.1.0

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental customGitFetch feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

References

github.com/sourcegraph/sourcegraph/pull/42704

github.com/sourcegraph/sourcegraph/security/advisories/GHSA-4qhq-4x4h-fxm8

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

Related for OSV:CVE-2022-41943