CVE-2022-41943

2022-11-2219:15:18

CWE-276

[email protected]

web.nvd.nist.gov

sourcegraph

code intelligence

cve-2022-41943

patch 4.1.0

nvd

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

0.001 Low

EPSS

Percentile

42.0%

JSON

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental customGitFetch feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.

Affected configurations

Vulners

NVD

Node

sourcegraphsourcegraphRange<4.1.0

VendorProductVersionCPE
sourcegraphsourcegraph*cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sourcegraph	sourcegraph	*	cpe:2.3:a:sourcegraph:sourcegraph::::::::

CNA Affected

[
  {
    "vendor": "sourcegraph",
    "product": "sourcegraph",
    "versions": [
      {
        "version": "< 4.1.0",
        "status": "affected"
      }
    ]
  }
]